=1.1.0"}, "RULE-CAMPAIGN-FAKEPLUGIN-INSTALL-BLOCK-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/update\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "upload-plugin"}, {"name": "FILES:pluginzip:name", "type": "regex", "value": "~^(platformist-quadendpointer|theme-js-wpcode|framework-triappment)\\\\.zip$~i"}], "cve": "CAMPAIGN-FAKEPLUGIN-INSTALL-BLOCK-01", "description": "Blocks upload of known fake-plugin archives at the WordPress plugin\\ninstall endpoint. Seed slugs are confirmed malicious backdoor-dropper\\nplugins (wp_org_exists=false, shared payload generator signature) that\\ninstall further payloads when activated. Fires on the plugin upload\\nstep before the zip is extracted, preventing backdoor deployment via\\nstolen or compromised admin credentials. The slug denylist should be\\nupdated as new IOC slugs are identified via the malware research\\npipeline. This rule covers the HTTP install vector; on-disk detection\\nis handled by AiBolit recognizers via the malware-team pipeline.\\n", "method": "POST", "mode": "block", "severity": 9.0, "tags": ["fake-plugin-install", "post-compromise", "dropper", "php-bkdr-wpplugin-mal", "admin-credential-abuse", "wpplugin1-family"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-LEARNPRESS-C-ONLY-FIELDS-SQLI-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/learnpress/v1/(courses|profile/course-tab)([/?&]|$)~i"}, {"name": "ARGS:c_only_fields", "type": "detectSQLi"}], "cve": "CAMPAIGN-2026-W18-LEARNPRESS-CFIELDS-SQLI", "description": "LearnPress \\u2014 block SQL injection attempts via the \'c_only_fields\' query parameter on the REST endpoints /wp-json/learnpress/v1/courses and /wp-json/learnpress/v1/profile/course-tab. The parameter is a column-name projection list; legitimate values are bare identifiers. SQL keywords or function-call syntax in the value indicates injection.", "mode": "block", "severity": 8.5, "slug": "learnpress", "tags": ["sql-injection", "rest-api", "unauthenticated"], "target": "plugin", "versions": ">=0"}, "RULE-CAMPAIGN-SC-REST-CMD-CHANNEL-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[a-z0-9]+(?:-[a-z0-9]+)+-[0-9a-f]{4}/v1/cmd([/?&]|$)~i"}], "cve": "CAMPAIGN-2026-W37-SC-REST-CMD", "description": "Detects the SC framework REST command channel. SC v2.8.1 registers an\\nunauthenticated REST route at /wp-json//v1/cmd with Ed25519 request signing,\\ncarrying fifteen commands including exec, install_plugin, create_user and inject_js.\\nSlugs are generated as a plausible multi-word WordPress feature name plus a four-hex\\nsuffix. Observed fleet-wide over seven days: cors-handler-b1fd, cors-handler-1a0f,\\nheartbeat-controller-22dc, heartbeat-controller-23cb, shortcode-renderer-f1a4,\\ncomment-spam-filter-26e6, image-compression-service-f283, http-request-handler-c12d,\\ndeferred-script-loader-9703, post-meta-indexer-5959, admin-bar-optimizer-29c3,\\nthumbnail-regenerator-dea4, rest-api-cache-6702, login-throttle-service-eee8. Two base\\nnames recurring under different hex suffixes is what confirms generation rather than\\nhand-picking. The mandatory four-hex tail on a multi-word prefix is the false-positive\\nfloor: other /v1/cmd routes seen in the same window (wab, cg, vs-admin, wpcli-bridge,\\nwp-update) do not match and are deliberately excluded.\\n", "mode": "block", "severity": 9.0, "tags": ["post-compromise", "backdoor", "command-channel", "core-fs-path-coverage"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-SC-ROGUE-ADMIN-LOGIN-01": {"action": "init", "block_policy": "never_block", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-login\\\\.php([?#]|$)~i"}, {"name": "ARGS:log", "type": "regex", "value": "~^(?:administrator_[0-9a-f]{6}|adm_[0-9a-f]{10}|admin_[0-9a-f]{10}|backup_[0-9]{10})$~"}], "cve": "CAMPAIGN-2026-W37-SC-ROGUE-ADMIN", "description": "Detects login attempts using the SC framework\'s generated administrator\\naccounts. The framework creates hidden admin users and the operator then authenticates\\nwith them normally, so the credential is valid and nothing upstream objects. Observed\\nshapes: administrator_<6 hex>, adm_<10 hex>, admin_<10 hex>, backup_<10 digits>,\\nindependently documented across ten incident cases by the DEFA case series and\\nconfirmed in production at 34,767 wp-login POSTs across 4,199 domains in three days.\\nPasswords accompanying them are per-site 24-hex-character strings rather than\\ndictionary guesses, which distinguishes this from ordinary brute-force traffic. No\\nlegitimate WordPress installation generates usernames of this shape, and the existing\\nModSec rule 77433257 does not cover them - it matches usr_<6-10 hex>, a different\\nmalware family\'s convention.\\n", "method": "POST", "mode": "pass", "severity": 8.5, "tags": ["post-compromise", "rogue-admin", "credential-abuse", "core-param-coverage"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-SC-SW-CLEANUP-01": {"ajax_action": "imunify_security_payload_carrier", "block_policy": "never_block", "conditions": [{"name": "client_payload_carrier", "type": "probabilistic", "value": "0"}], "cve": "CAMPAIGN-SC-SW-CLEANUP", "description": "A service worker from the SC malware campaign is registered in an administrator\'s browser. It survives server-side cleanup and can re-infect the site.", "mode": "pass", "payload": {"actions": {"reload": {"enabled": true, "prompt": {"admin": "none", "login": "none"}}}, "contexts": ["admin", "login"], "enabled": true, "enforce": true, "id": "sw-cleanup", "limits": {"verdict_ttl_days": 7}, "match": {"required_signals": 1, "script_url_regex": ["[?&]sc_[0-9a-fA-F]{6}=1(?:[&#]|$)", "^[^?#]*/\\\\?p=[0-9]{8,12}(?:[&#]|$)"]}, "schema": 1, "version": 6}, "severity": 9.0, "slug": "imunify-security", "tags": ["client-payload", "service-worker"], "target": "plugin", "versions": ">=4.1.2"}, "RULE-CAMPAIGN-SCPB-BEACON-01": {"action": "init", "block_policy": "never_block", "conditions": [{"name": "ARGS:sc_pb", "type": "regex", "value": "~^[0-9]{13}$~"}], "cve": "CAMPAIGN-2026-W37-SCPB-BEACON", "description": "Detects the client-side beacon of the sc_pb/sc_c mass-implant campaign.\\nThe injected page script polls the site root with sc_pb=<13-digit millisecond\\nepoch> as a cache-buster; the implanted mu-plugin answers the request and drives\\nan outbound cURL call to the operator infrastructure through the WordPress HTTP\\nAPI. 100% of observed values are exactly 13 digits. Production one-day window\\n2026-09-08: 502,159 requests across 23,186 domains and 3,482 servers, of which\\n98.1% also execute a campaign-shaped dropper file. Zero occurrences fleet-wide\\nbefore 2026-09-01. Starts in pass mode pending the false-positive floor check.\\n", "mode": "pass", "severity": 8.0, "tags": ["post-compromise", "beacon", "mass-campaign", "core-param-coverage"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-SCPB-CANARY-MONITOR-01": {"action": "init", "block_policy": "never_block", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~\\\\A/(?:[^/?#\\\\r\\\\n]+/)*(?:wp-login\\\\.php)?\\\\?(?=(?:[^&]*&)*sc_c=[0-9a-f]{16}(?:&|\\\\z))(?=(?:[^&]*&)*_r=[0-9]{6}(?:&|\\\\z))[A-Za-z0-9_-]+=[^?&#\\\\r\\\\n]*(?:&[A-Za-z0-9_-]+=[^?&#\\\\r\\\\n]*)*\\\\z~"}, {"name": "REQUEST_HEADERS:User-Agent", "type": "regex", "value": "~^WordPress/[0-9]~"}, {"name": "ARGS:sc_c", "type": "regex", "value": "~\\\\A[0-9a-f]{16}\\\\z~"}, {"name": "ARGS:_r", "type": "regex", "value": "~\\\\A[0-9]{6}\\\\z~"}, {"type": "probabilistic", "value": "0.0005"}], "cve": "CAMPAIGN-2026-W37-SCPB-IMPLANT-ID", "description": "Samples SC canary checks carrying sc_c and _r on directory or WordPress login URLs.", "method": "GET", "mode": "pass", "severity": 1.0, "tags": ["monitor", "post-compromise-signature", "infection-unconfirmed", "sampled-observation"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-SCPB-HIDDEN-DIR-MONITOR-01": {"action": "init", "block_policy": "never_block", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-content/\\\\.sc_[0-9a-f]{8}/~i"}], "cve": "CAMPAIGN-2026-W37-SCPB-HIDDEN-DIR", "description": "Monitors direct HTTP access to the campaign hidden payload directory\\nwp-content/.sc_<8 hex>/. No WordPress distribution, plugin or theme ships a\\ndot-prefixed directory under wp-content, so the path cannot resolve on a clean\\ninstallation and every hit is attacker or researcher traffic by construction\\n(zero false-positive floor). The directory holds the implant module set\\n(.g_/.gr_/.gs_/.gm_/.gv_/.gk_/.gl_/.gsu_ plus own_<8hex>.php and the\\ncore_<8hex>.php kill switch) and the implant writes its own .htaccess there,\\nso a probe is likely denied before PHP executes. That is why PHP-layer\\ntelemetry records nothing on this surface and why a request-layer rule is the\\ninstrument that can answer whether it is probed at all. Ships pass with\\nblock_policy: never_block \\u2014 it is a monitor by design, and the release\\npipeline must not auto-promote it into an enforcing rule on the strength of\\na zero-false-positive record alone.\\n", "mode": "pass", "severity": 2.0, "tags": ["post-compromise-probe", "filesystem-planted-backdoor", "hidden-directory", "monitor", "core-fs-path-coverage"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-SCPB-IMPLANT-ID-01": {"action": "init", "block_policy": "never_block", "conditions": [{"name": "ARGS:sc_c", "type": "regex", "value": "~^[0-9a-f]{16}$~"}], "cve": "CAMPAIGN-2026-W37-SCPB-IMPLANT-ID", "description": "Detects the per-site implant identifier of the sc_pb/sc_c mass-implant\\ncampaign. The implanted loader answers requests carrying sc_c=<16 lowercase hex>\\non / and /wp-login.php. The value is constant per victim host (one distinct\\nvalue per domain across a full production day), which makes it an implant ID\\nrather than a cache-buster. This parameter had zero occurrences fleet-wide\\nbefore 2026-09-01 and reached 45,986 distinct domains by 2026-09-08, a growth\\nshape no legitimately-distributed plugin produces. Starts in pass mode so the\\nrelease pipeline can confirm the false-positive floor before promotion.\\nThis rule does NOT remediate the compromise; it severs one implant control\\nchannel and routes the host to filesystem-integrity investigation.\\n", "mode": "pass", "severity": 8.5, "tags": ["post-compromise", "implant-control-channel", "mass-campaign", "core-param-coverage"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-SCPB-IMPLANT-ID-COMPANION-01": {"action": "init", "block_policy": "never_block", "companion_for": "RULE-CAMPAIGN-SCPB-IMPLANT-ID-01", "conditions": [{"name": "ARGS:sc_c", "type": "exists"}], "cve": "CAMPAIGN-2026-W37-SCPB-IMPLANT-ID", "description": "Relaxed sampling sibling of RULE-CAMPAIGN-SCPB-IMPLANT-ID-01. Matches\\nany sc_c value regardless of shape so that operator rotation of the identifier\\nformat (length or alphabet) is visible as companion>0 while primary=0. Never\\npromoted to block.\\n", "mode": "pass", "severity": 1.0, "tags": ["companion-sampler", "mass-campaign"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-SCPB-LOOPBACK-MONITOR-01": {"action": "init", "block_policy": "never_block", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~\\\\A/(?:[^/?#\\\\r\\\\n]+/)*\\\\?(?=(?:[^&]*&)*sc_pb=[0-9]{13}(?:&|\\\\z))[A-Za-z0-9_-]+=[^?&#\\\\r\\\\n]*(?:&[A-Za-z0-9_-]+=[^?&#\\\\r\\\\n]*)*\\\\z~"}, {"name": "REQUEST_HEADERS:User-Agent", "type": "regex", "value": "~^WordPress/[0-9]~"}, {"name": "ARGS:sc_pb", "type": "regex", "value": "~\\\\A[0-9]{13}\\\\z~"}, {"type": "probabilistic", "value": "0.0005"}], "cve": "CAMPAIGN-2026-W37-SCPB-BEACON", "description": "Samples SC loopback checks carrying sc_pb on directory URLs.", "method": "GET", "mode": "pass", "severity": 1.0, "tags": ["monitor", "post-compromise-signature", "infection-unconfirmed", "sampled-observation"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-SCPB-WLH-CHANNEL-01": {"action": "init", "block_policy": "never_block", "conditions": [{"name": "ARGS:/wlhck(?![\\\\s\\\\S])/", "type": "regex", "value": "~\\\\A[0-9A-Za-z]{8}\\\\z~"}], "cve": "CAMPAIGN-2026-W37-SCPB-WLH", "description": "Monitors the SC wlhck channel: exactly eight ASCII alphanumeric characters. Historical WLH-CHANNEL-01 also covered wlh_sc; from this split, wlh_sc telemetry belongs to WLH-CHANNEL-02. Parameter shape alone does not establish compromise.", "mode": "pass", "severity": 7.5, "tags": ["post-compromise", "implant-control-channel", "mass-campaign", "core-param-coverage"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-SCPB-WLH-CHANNEL-02": {"action": "init", "block_policy": "never_block", "conditions": [{"name": "ARGS:/wlh_sc(?![\\\\s\\\\S])/", "type": "regex", "value": "~\\\\A[0-9A-Za-z]{12}\\\\z~"}], "cve": "CAMPAIGN-2026-W37-SCPB-WLH", "description": "Monitors the SC wlh_sc channel: exactly twelve ASCII alphanumeric characters. Split from historical WLH-CHANNEL-01 so each parameter keeps its observed length. Parameter shape alone does not establish compromise.", "mode": "pass", "severity": 7.5, "tags": ["post-compromise", "implant-control-channel", "mass-campaign", "core-param-coverage"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-SERVICE-WORKER-FETCH-PROBE-01": {"action": "init", "block_policy": "never_block", "conditions": [{"name": "REQUEST_HEADERS:Service-Worker", "type": "equals", "value": "script"}, {"type": "probabilistic", "value": "0.005"}], "cve": "CAMPAIGN-2026-W37-SERVICE-WORKER-TELEMETRY", "description": "Telemetry-only sampler. Browsers send the request header\\n\\"Service-Worker: script\\" on service-worker registration and on the periodic\\nupdate fetch, so this rule records which WordPress-served URLs are being\\nregistered as service workers. A rogue service worker gives an attacker\\npersistent client-side MITM on every subsequent navigation, and the\\nregistration URL is not otherwise recoverable from any Imunify telemetry\\nstream today. Sampling is capped at 1 request in 200 because legitimate PWA\\nplugins (SuperPWA, Webpushr, Firebase messaging, PWA for WP) register service\\nworkers on 11,598 distinct domains per day; the header alone is not a\\ncompromise signal, it is the collection surface that makes rogue registrations\\nfindable. Never promoted to block.\\n", "mode": "pass", "severity": 1.0, "tags": ["telemetry", "service-worker", "client-side-persistence"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-TRIBE-V1-EVENTS-STATUS-SQLI-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tribe/events/v1/events([/?&]|$)~i"}, {"name": "ARGS:status", "type": "detectSQLi"}], "cve": "CAMPAIGN-2026-W18-TRIBE-STATUS-SQLI", "description": "The Events Calendar \\u2014 block SQL injection attempts via the \'status\' query parameter on the REST endpoint /wp-json/tribe/events/v1/events. Complements existing coverage for the documented \'s\' parameter SQLi (CVE-2025-9807, CVE-2025-12197) and \'order\' parameter SQLi (CVE-2024-8275).", "mode": "block", "severity": 8.5, "slug": "the-events-calendar", "tags": ["sql-injection", "rest-api", "unauthenticated"], "target": "plugin", "versions": ">=0"}, "RULE-CAMPAIGN-WP-EDITOR-AUTH-COOKIE-02": {"ajax_action": "edit-theme-plugin-file", "conditions": [{"name": "ARGS:/^file$/", "type": "regex", "value": "~\\\\.php$~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~<\\\\?(?:php\\\\b|=)?~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~(?is)(?=.*\\\\$[A-Za-z_]\\\\w*(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*=(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\bget_users(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?=[^;]{0,512}\\\\b(?:role|roles)\\\\b[^;]{0,512}\\\\badministrator\\\\b))(?=.*\\\\bwp_set_current_user(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\$[A-Za-z_]\\\\w*(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*(?:\\\\[\\\\s*\\\\d+\\\\s*\\\\])?(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*->(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*ID\\\\b)(?=.*\\\\bwp_set_auth_cookie(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\$[A-Za-z_]\\\\w*(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*(?:\\\\[\\\\s*\\\\d+\\\\s*\\\\])?(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*->(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*ID\\\\b)~"}], "cve": "CAMPAIGN-2026-WP-EDITOR-ABUSE", "description": "Block WordPress core editor writes that select an administrator and create an authentication cookie.", "method": "POST", "mode": "block", "severity": 9.0, "tags": ["authenticated-editor-abuse", "authentication-backdoor", "post-compromise", "wordpress-core-entrypoint"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-WP-EDITOR-REQUEST-CALLABLE-01": {"ajax_action": "edit-theme-plugin-file", "conditions": [{"name": "ARGS:/^file$/", "type": "regex", "value": "~\\\\.php$~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~<\\\\?(?:php\\\\b|=)?~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~(?is)(?=.*\\\\bextract(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\$_(?:REQUEST|GET|POST)\\\\b)(?=.*(?:\\\\$[A-Za-z_]\\\\w*|\\\\bcall_user_func|\\\\$_(?:REQUEST|GET|POST)\\\\s*\\\\[\\\\s*[\\\\x22\\\\x27][A-Za-z_]\\\\w*[\\\\x22\\\\x27]\\\\s*\\\\]|\\\\$\\\\{\\\\s*[\\\\x22\\\\x27][A-Za-z_]\\\\w*[\\\\x22\\\\x27]\\\\s*\\\\})(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\()~"}], "cve": "CAMPAIGN-2026-WP-EDITOR-ABUSE", "description": "Block WordPress core editor writes that extract request variables and invoke an attacker-selected PHP callable.", "method": "POST", "mode": "block", "severity": 9.0, "tags": ["authenticated-editor-abuse", "php-backdoor", "post-compromise", "wordpress-core-entrypoint"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-WP703-SSRF-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/[^?]*)?/wp-json/(?:wp-block-editor/v1/url-details|oembed/1\\\\.0/proxy)(?:[/?]|$)~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^https?://(?:(?:192\\\\.(?:0\\\\.(?:0|2)|88\\\\.99)|198\\\\.51\\\\.100|203\\\\.0\\\\.113)\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|169\\\\.254\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|100\\\\.(?:6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|198\\\\.(?:18|19)\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(?:22[4-9]|23[0-9]|24[0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\\\\.?(?::(?:80|443|8080))?(?:[/?#]|$)~i"}], "cve": "WP-7.0.3-SSRF-SPECIAL-IPV4", "cve_link": "https://github.com/WordPress/wordpress-develop/commit/3bc03dbb7f24365cb0bceead54ccabafa65dfff6", "description": "WordPress 7.0.0 through 7.0.2 partial virtual patch for literal special-purpose IPv4 targets submitted to the URL Details and oEmbed proxy REST endpoints.", "mode": "block", "tags": ["ssrf", "rest-api", "authenticated", "wp-core", "partial-coverage"], "target": "core", "versions": ">=7.0.0 <7.0.3"}, "RULE-CAMPAIGN-WP703-SSRF-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/(?:wp-block-editor/v1/url-details|oembed/1\\\\.0/proxy)/*$~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^https?://(?:(?:192\\\\.(?:0\\\\.(?:0|2)|88\\\\.99)|198\\\\.51\\\\.100|203\\\\.0\\\\.113)\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|169\\\\.254\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|100\\\\.(?:6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|198\\\\.(?:18|19)\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(?:22[4-9]|23[0-9]|24[0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\\\\.?(?::(?:80|443|8080))?(?:[/?#]|$)~i"}], "cve": "WP-7.0.3-SSRF-SPECIAL-IPV4", "cve_link": "https://github.com/WordPress/wordpress-develop/commit/3bc03dbb7f24365cb0bceead54ccabafa65dfff6", "description": "WordPress 7.0.0 through 7.0.2 partial virtual patch for literal special-purpose IPv4 targets submitted through rest_route to URL Details and oEmbed proxy.", "mode": "block", "tags": ["ssrf", "rest-api", "authenticated", "wp-core", "partial-coverage"], "target": "core", "versions": ">=7.0.0 <7.0.3"}, "RULE-CAMPAIGN-WPCONFIG-BACKUP-EXFIL-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^[^?#]*/\\\\.?wp-config\\\\.php[^/?#]+~i"}], "cve": "CAMPAIGN-WPCONFIG-BACKUP-EXFIL", "description": "Block credential-harvesting recon for wp-config.php derivatives \\u2014 editor\\nswap files (.swp/.swo/.un~/~), operator backups (.bak/.old/.save/.orig),\\nand archive/rename artefacts (.zip/.txt/.1/.copy). WordPress core ships\\nexactly one wp-config.php and never a suffixed sibling, so a request for\\n`wp-config.php` is attacker traffic by construction \\u2014 the same\\nzero-FP-floor reasoning as RULE-CAMPAIGN-MAINT-INDEX-01. A hit that\\nreturns 200 leaks DB credentials and AUTH_KEY salts verbatim.\\n\\nEvidence (ClickHouse `incident`, full day 2026-08-20, `plugin_id=\'modsec\'`):\\n2,154,801 matching requests across 32,887 distinct servers and 2,106\\ndistinct URI variants. Of those, 1,282,803 (59.5%) were NOT denied by any\\nexisting rule \\u2014 this rule closes that pass-through gap. 100% of matching\\nrows are `modsec`, i.e. server-side observations that the behaviour exists\\nat scale; this is not a measurement of WP-engine coverage. The surface\\ncarries no wp-rules coverage today: `wp-config` appears 0 times in\\ninitial-rules.yaml.\\n", "mode": "block", "severity": 7.0, "tags": ["credential-exposure", "config-disclosure", "recon", "unauthenticated", "zero-fp-floor"], "target": "core", "versions": ">=0"}, "RULE-CAMPAIGN-WPMATES-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-mates\\\\.php($|\\\\?)~"}], "cve": "CAMPAIGN-WPMATES-01", "description": "Blocks requests to /wp-mates.php, a documented planted-backdoor filename\\nnot present in WordPress core or any tracked legitimate plugin or theme\\ndistribution. Any HTTP request to this path is a post-compromise callback\\nprobe from a threat actor confirming the backdoor remains reachable. The\\nfile must be removed from the filesystem and admin credentials rotated;\\nthis rule blocks the probe but does not remediate the underlying\\ncompromise.\\n", "method": "GET", "mode": "block", "severity": 9.0, "tags": ["post-compromise-probe", "dropper-survival-check", "filesystem-planted-backdoor", "core-fs-path-coverage", "wp-mates-backdoor"], "target": "core", "versions": "<=999.999.999"}, "RULE-CVE-2013-2010-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~ (eval, RCE) and (include, LFI) found literally in the rendered page buffer (lib/W3/PgCache.php _parse_dynamic L1390-1400, eval L1416). Attacker content (comment/post/excerpt/trackback body) carries the literal \\"\\\\s*(?:]|<[^>]+\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2023-7071", "description": "Essential Blocks <=4.4.6 contributor+ stored XSS via Table of Contents block attributes", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2023-7291-01": {"ajax_action": "paytium_mollie_create_account", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-02": {"ajax_action": "paytium_mollie_create_profile", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-03": {"ajax_action": "pt_save_profile_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-04": {"ajax_action": "pt_get_mollie_profiles", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-05": {"ajax_action": "paytium_sw_save_api_keys", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2024-0221-01": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_new_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_new_name in addImages rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-02": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-03": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "remove_items"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages remove_items", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-deletion"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-04": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "copy"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages copy", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-copy"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-05": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "move"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages move", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-move"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-06": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_new_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_new_name in addMusic rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-07": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-08": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "remove_items"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic remove_items", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-deletion"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-09": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "copy"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic copy", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-copy"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-10": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "move"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic move", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-move"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0378-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-json/mwai(?:-ui)?/v1/(?:chats/submit|chat|simpleChatbotQuery)(?:/|\\\\?|$)~i"}, {"name": "ARGS:newMessage", "type": "regex", "value": "~<\\\\s*script\\\\b[^>]*>.*?<\\\\/\\\\s*script\\\\s*>|<[^>]+\\\\b(?:href|src)\\\\s*=\\\\s*(?:[\\"\']?)\\\\s*(?:javascript|vbscript)\\\\s*:|<[^>]+\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=\\\\s*[\\"\']~is"}], "cve": "CVE-2024-0378", "description": "Stored XSS via AI chat message in AI Engine plugin REST API", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ai-engine", "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2024-0405-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/burst/v1/data/compare(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2024-0405", "description": "Burst Statistics <=1.5.3 authenticated SQL injection via data/compare REST endpoint", "mode": "block", "severity": 7.2, "slug": "burst-statistics", "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2024-0405-02": {"ajax_action": "burst_rest_api_fallback", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2024-0405", "description": "Burst Statistics <=1.5.3 authenticated SQL injection via REST API fallback AJAX handler", "mode": "block", "severity": 7.2, "slug": "burst-statistics", "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2024-0508-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:javascript|data)[ \\\\t]*:~i"}], "cve": "CVE-2024-0508", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0508", "description": "Orbit Fox by ThemeIsle <=2.10.27 contributor+ stored XSS via Pricing Table widget link URL - Elementor AJAX save path", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored", "authenticated", "elementor"], "target": "plugin", "versions": "<=2.10.27"}, "RULE-CVE-2024-0508-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/(?:document/save|documents)(?:[/?]|$)~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:javascript|data)[ \\\\t]*:~i"}], "cve": "CVE-2024-0508", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0508", "description": "Orbit Fox by ThemeIsle <=2.10.27 contributor+ stored XSS via Pricing Table widget link URL - Elementor REST save path", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored", "authenticated", "elementor", "rest-api"], "target": "plugin", "versions": "<=2.10.27"}, "RULE-CVE-2024-0608-01": {"ajax_action": "erp_crm_track_email_opened", "conditions": [{"name": "ARGS:email", "type": "detectSQLi"}], "cve": "CVE-2024-0608", "mode": "block", "severity": 8.8, "slug": "erp", "target": "plugin", "versions": "<=1.13.1"}, "RULE-CVE-2024-0659-01": {"action": "admin_init", "conditions": [{"name": "ARGS:edd-action", "type": "equals", "value": "tools_tab_debug_log"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-0659", "description": "Easy Digital Downloads <=3.1.5 unauthorized access to debug log tools action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "easy-digital-downloads", "tags": ["broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=3.2.6"}, "RULE-CVE-2024-0660-01A": {"ajax_action": "frm_save_form", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "frm_save_form"}, {"name": "ARGS:success_msg", "type": "detectXSS"}], "cve": "CVE-2024-0660", "description": "Formidable Forms <=6.7.2 CSRF-to-stored-XSS via admin-ajax frm_save_form (missing nonce validation)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "formidable", "tags": ["xss", "csrf", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.7.2"}, "RULE-CVE-2024-0660-01B": {"ajax_action": "frm_save_form", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "frm_save_form"}, {"name": "ARGS:custom_html", "type": "detectXSS"}], "cve": "CVE-2024-0660", "description": "Formidable Forms <=6.7.2 CSRF-to-stored-XSS via admin-ajax frm_save_form (missing nonce validation)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "formidable", "tags": ["xss", "csrf", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.7.2"}, "RULE-CVE-2024-0668-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^advanced_db_cleaner~"}, {"name": "ARGS:aDBc_cron_elements", "type": "regex", "value": "~(?:^|%[0-9A-Fa-f]{2}|[&=\\\\[\\\\]\\"\'])[OCa]\\\\s*(?::|%3[Aa])\\\\s*[0-9]+\\\\s*(?::|%3[Aa])~"}], "cve": "CVE-2024-0668", "description": "Advanced Database Cleaner <=3.1.3 authenticated PHP object injection via process_bulk_action unserialize of aDBc_cron_elements on plugin admin page", "mode": "block", "severity": 7.2, "slug": "advanced-database-cleaner", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2024-0668-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^advanced_db_cleaner~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"[A-Za-z_\\\\\\\\][A-Za-z0-9_\\\\\\\\]*\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-0668", "description": "Advanced Database Cleaner <=3.1.3 PHP object injection payload in any plugin admin POST parameter via bulk action serialized object marker", "mode": "block", "severity": 7.2, "slug": "advanced-database-cleaner", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2024-0685-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^(?:wp-privacy-export-personal-data|remove_personal_data)$~"}, {"name": "ARGS:email_address", "type": "regex", "value": "~(?:\'|%27|\\\\\\\\\')(?:[^@]{0,80})(?:(?:/\\\\*|%2F\\\\*)|(?:\\\\s|%20|\\\\+)(?:OR|AND|UNION)(?:\\\\s|%20|\\\\+|\\\\()|(?:--|%2D%2D|#|%23)|;|\\\\|\\\\||!=)~i"}], "cve": "CVE-2024-0685", "description": "Ninja Forms <=3.7.1 SQLi metacharacters in email_address on WP privacy export trigger reaching get_subs_by_email", "mode": "block", "severity": 9.8, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.7.1"}, "RULE-CVE-2024-0699-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/~i"}, {"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:php(?:[0-9s]?|t|tm)?|pht|phtml|phar|shtml|asp|aspx|jsp|cgi)(?:[?#]|$)~i"}], "cve": "CVE-2024-0699", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-0699-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^https?://169\\\\.254\\\\.169\\\\.254(?:[/:?#]|$)~i"}], "cve": "CVE-2024-0699", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-0709-01A": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:coinslist", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-0709", "mode": "block", "severity": 7.5, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": ">=2.0 <=2.6.5"}, "RULE-CVE-2024-0709-01B0": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:coinslist[0]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-0709", "mode": "block", "severity": 7.5, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": ">=2.0 <=2.6.5"}, "RULE-CVE-2024-0709-01B1": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:coinslist[1]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-0709", "mode": "block", "severity": 7.5, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": ">=2.0 <=2.6.5"}, "RULE-CVE-2024-0786-01": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:conditionData", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via conditionData in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-02": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:valueData", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via valueData in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-03": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:exclude", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via exclude in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-04": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:include", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via include in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-05": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:productArray", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via productArray in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0825-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/vimeography/v1/galleries/\\\\d+/duplicate(/|\\\\?|$)~"}, {"name": "ARGS:vimeography_duplicate_gallery_serialized", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-0825", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0825", "description": "Vimeography <=2.3.2 PHP Object Injection via deserialization of untrusted input in duplicate gallery REST endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "vimeography", "tags": ["object-injection", "deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.3.2"}, "RULE-CVE-2024-0852-01": {"action": "template_redirect", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration)\\\\s*=|javascript:~i"}], "cve": "CVE-2024-0852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0852", "description": "coreActivity <1.8.1 unauthenticated stored XSS via REQUEST_URI logged and displayed unescaped in admin dashboard", "method": "GET", "mode": "block", "severity": 8.8, "slug": "coreactivity", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<1.8.1"}, "RULE-CVE-2024-0852-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration)\\\\s*=|javascript:~i"}], "cve": "CVE-2024-0852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0852", "description": "coreActivity <1.8.1 unauthenticated stored XSS via search query parameter logged and displayed unescaped", "method": "GET", "mode": "block", "severity": 8.8, "slug": "coreactivity", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<1.8.1"}, "RULE-CVE-2024-0856-01": {"action": "init", "conditions": [{"name": "ARGS:cpabc_ipncheck", "type": "regex", "value": "~(?:\'[[:space:]]*(?:or|and|union|select|insert|update|delete|drop|--|#)|;[[:space:]]*(?:select|insert|update|delete|drop|--|sleep|benchmark)|--|/\\\\*|\\\\*/|[[:<:]]or[[:space:]]+[0-9]+=+[0-9]+|[[:<:]]union[[:space:]]+(?:all[[:space:]]+)?select|[[:<:]]select[[:space:]].*[[:space:]]from)~i"}], "cve": "CVE-2024-0856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0856", "description": "Appointment Booking Calendar <=1.3.82 SQL injection via cpabc_ipncheck on init", "mode": "block", "severity": 8.8, "slug": "appointment-booking-calendar", "tags": ["sql-injection", "csrf", "unauthenticated"], "target": "plugin", "versions": "<1.3.83"}, "RULE-CVE-2024-0869-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/instant-images/license(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-0869", "method": "POST", "mode": "block", "severity": 6.5, "slug": "instant-images", "target": "plugin", "versions": "<=6.1.0"}, "RULE-CVE-2024-0952-01": {"ajax_action": "erp_acct_get_people", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(\\\\s*\\\\d+|BENCHMARK\\\\s*\\\\(|PG_SLEEP\\\\s*\\\\(|WAITFOR\\\\s+DELAY)~i"}, {"type": "missing_capability", "value": "erp_acct_manager"}], "cve": "CVE-2024-0952", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0952", "description": "WP ERP <=1.12.9 authenticated SQL injection via id parameter in erp_acct_get_people AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "erp", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=1.12.9"}, "RULE-CVE-2024-10002-01": {"ajax_action": "rover_idx_refresh_social", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10002", "description": "Rover IDX <=3.0.0.2905 authentication bypass to administrator via rover_idx_refresh_social AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "rover-idx", "tags": ["authentication-bypass", "missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=3.0.0.2905"}, "RULE-CVE-2024-10002-02": {"ajax_action": "rover_idx_social", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10002", "description": "Rover IDX <=3.0.0.2905 unauthorized social settings manipulation via rover_idx_social AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "rover-idx", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=3.0.0.2905"}, "RULE-CVE-2024-10079-01": {"ajax_action": "import_content", "conditions": [{"name": "ARGS:text", "type": "regex", "value": "~(^|[;{])\\\\s*(O|C):[0-9]+:\\"~"}], "cve": "CVE-2024-10079", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10079", "description": "WP Easy Post Types <=1.4.4 PHP Object Injection via unserialize of text parameter in import_content AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-post-types", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2024-10124-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ai/v1/vayu-site-builder(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10124", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10124", "description": "Vayu Blocks <=1.1.1 unauthenticated arbitrary plugin/theme installation via REST API /ai/v1/vayu-site-builder", "method": "POST", "mode": "block", "severity": 9.8, "slug": "vayu-blocks", "tags": ["missing-authorization", "arbitrary-plugin-install", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2024-10222-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~]|\\\\bon(?:load|error|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|xlink:href\\\\s*=\\\\s*[\\"\']?\\\\s*javascript~i"}], "cve": "CVE-2024-10222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10222", "description": "SVG Support <=2.5.10 stored XSS via unsanitized SVG file upload through REST API media endpoint", "mode": "block", "severity": 6.4, "slug": "svg-support", "tags": ["xss", "stored-xss", "file-upload", "svg", "rest-api"], "target": "plugin", "versions": "<=2.5.10"}, "RULE-CVE-2024-10247-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "video-gallery"}, {"name": "ARGS:orderby", "type": "detectSQLi"}], "cve": "CVE-2024-10247", "method": "GET", "mode": "block", "severity": 4.9, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2024-10247-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "video-gallery"}, {"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2024-10247", "method": "GET", "mode": "block", "severity": 4.9, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2024-10310-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~image_title[^}]*(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:svg|img|iframe|details|object|embed|math|audio|video|body|marquee|isindex|form|input|button|textarea|select|base|link|meta|style|applet|xml)[\\\\s/>][^}]*?\\\\bon(?:error|load|toggle|click|mouseover|focus|blur|pointerover|animationend|transitionend)\\\\s*=|<[^>]{0,50}javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-10310", "description": "Element Pack Elementor Addons <=5.10.1 Contributor+ Stored XSS via Custom Gallery Widget image_title parameter", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "target": "plugin", "versions": "<=5.10.1"}, "RULE-CVE-2024-10310-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~image_accordion_title[^}]*(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:svg|img|iframe|details|object|embed|math|audio|video|body|marquee|isindex|form|input|button|textarea|select|base|link|meta|style|applet|xml)[\\\\s/>][^}]*?\\\\bon(?:error|load|toggle|click|mouseover|focus|blur|pointerover|animationend|transitionend)\\\\s*=|<[^>]{0,50}javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-10310", "description": "Element Pack Elementor Addons <=5.10.1 Contributor+ Stored XSS via Image Accordion Widget image_accordion_title parameter", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "target": "plugin", "versions": "<=5.10.1"}, "RULE-CVE-2024-10322-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/(?:async-upload|media-new)\\\\.php|^/wp-json/wp/v2/media|(?:^|&|\\\\?)rest_route=/wp/v2/media)~i"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:]|\\\\son(?:load|error|click|mouseover|focus|blur|animationstart|animationiteration|animationend|begin|end|repeat)\\\\s*=|javascript\\\\s*:|]|xlink:href\\\\s*=\\\\s*[\\"\']\\\\s*(?:javascript|data):)~i"}], "cve": "CVE-2024-10322", "description": "Brizy <=2.6.8 author+ stored XSS via malicious SVG file upload (insufficient sanitization in wp_handle_upload_prefilter) - classic media upload endpoints", "mode": "block", "severity": 5.4, "slug": "brizy", "target": "plugin", "versions": "<=2.6.8"}, "RULE-CVE-2024-10322-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(?:]|\\\\son(?:load|error|click|mouseover|focus|blur|animationstart|animationiteration|animationend|begin|end|repeat)\\\\s*=|javascript\\\\s*:|]|xlink:href\\\\s*=\\\\s*[\\"\']\\\\s*(?:javascript|data):)~i"}], "cve": "CVE-2024-10322", "description": "Brizy <=2.6.8 author+ stored XSS via malicious SVG upload through REST media endpoint (file field)", "mode": "block", "severity": 5.4, "slug": "brizy", "target": "plugin", "versions": "<=2.6.8"}, "RULE-CVE-2024-10367-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:content", "type": "regex", "value": "~<\\\\s*script[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:embed|object|iframe)[\\\\s/>]~i"}], "cve": "CVE-2024-10367", "description": "Otter Blocks <=3.0.4 stored XSS via malicious SVG file upload through REST API media endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "otter-blocks", "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2024-1037-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^aiowpsec~i"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:<|%3[Cc]|%25(?:3[Cc]|2[5%]3[Cc]))(?:script|svg|img|iframe|s[\\\\s/]*v[\\\\s/]*g|/?[a-z]+[\\\\s/]+on[a-z]+\\\\s*=)|on(?:load|error|click|mouseover|focus|submit)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*(?:script|html)~i"}], "cve": "CVE-2024-1037", "description": "All-In-One Security (AIOS) <=5.2.5 reflected XSS via tab parameter on AIOS admin pages (wp-security-list-404.php)", "mode": "block", "severity": 6.1, "slug": "all-in-one-wp-security-and-firewall", "target": "plugin", "versions": "<=5.2.5"}, "RULE-CVE-2024-10392-01": {"ajax_action": "wpaicg_save_image_media", "conditions": [{"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-10392", "method": "POST", "mode": "block", "severity": 9.8, "slug": "gpt3-ai-content-generator", "target": "plugin", "versions": "<=1.8.89"}, "RULE-CVE-2024-10400-01": {"ajax_action": "load_filtered_instructor", "conditions": [{"name": "ARGS:rating_filter", "type": "regex", "value": "~[^1-5]~"}], "cve": "CVE-2024-10400", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10400", "description": "Tutor LMS <=2.7.6 unauthenticated SQLi via rating_filter POST param in the load_filtered_instructor AJAX action (Utils::get_instructors HAVING clause, Utils.php:3193)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "tutor", "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2024-10402-01": {"ajax_action": "forminator_save_builder", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10402", "description": "Forminator <=1.35.1 missing authorization on forminator_save_builder allows contributor+ form creation/editing", "mode": "block", "severity": 8.8, "slug": "forminator", "target": "plugin", "versions": "<=1.35.1"}, "RULE-CVE-2024-10453-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~global_typography_title.*?(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-10583", "description": "Popup Maker <=1.20.2 authenticated (Contributor+) stored XSS via post_title in popup post type", "mode": "block", "severity": 5.4, "slug": "popup-maker", "target": "plugin", "versions": "<=1.20.2"}, "RULE-CVE-2024-1061-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/h5vp/v1/view(?:/|\\\\?|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:AND|OR|UNION|SELECT|--|#)|/\\\\*[^*]*\\\\*/|--\\\\s)~i"}], "cve": "CVE-2024-1061", "description": "HTML5 Video Player <2.5.25 unauthenticated SQL injection via id parameter in REST API get_view endpoint", "mode": "block", "severity": 9.8, "slug": "html5-video-player", "target": "plugin", "versions": "<2.5.25"}, "RULE-CVE-2024-10687-01": {"ajax_action": "post_cg_get_raw_data_from_galleries", "conditions": [{"name": "ARGS:collectedIds", "type": "regex", "value": "~[^0-9,\\\\s]~"}], "cve": "CVE-2024-10687", "method": "POST", "mode": "block", "severity": 9.8, "slug": "contest-gallery", "target": "plugin", "versions": "<=24.0.3"}, "RULE-CVE-2024-1070-01": {"ajax_action": "so_widgets_setting_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|body|input|details|marquee)[\\\\s>])~i"}], "cve": "CVE-2024-1070", "description": "SiteOrigin Widgets Bundle <=1.58.2 contributor+ stored XSS via Features widget instance fields on so_widgets_setting_save", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.58.2"}, "RULE-CVE-2024-1070-02": {"ajax_action": "so_widgets_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|body|input|details|marquee)[\\\\s>])~i"}], "cve": "CVE-2024-1070", "description": "SiteOrigin Widgets Bundle <=1.58.2 contributor+ stored XSS via Features widget rendered through so_widgets_preview AJAX", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.58.2"}, "RULE-CVE-2024-1071-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:sorting", "type": "detectSQLi"}], "cve": "CVE-2024-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1071", "description": "Ultimate Member >=2.1.3 <=2.8.2 unauthenticated SQL injection via sorting parameter in um_get_members AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ultimate-member", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": ">=2.1.3 <=2.8.2"}, "RULE-CVE-2024-10711-02": {"action": "admin_post_itwr_activation_plugin", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "itwr_activation_plugin"}, {"name": "ARGS:default_role", "type": "exists"}], "cve": "CVE-2024-10711", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ithemelandco-woo-report", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2024-10715-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:mappress/map[\\\\s\\\\S]{0,4000}?(?:]|on(?:load|error|click|mouseover|focus|mouseenter|mouseout|submit|change|input|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-10715", "description": "MapPress Maps for WordPress <=2.94.1 contributor+ stored XSS via mappress/map Gutenberg block attributes (REST posts endpoint)", "mode": "block", "severity": 5.4, "slug": "mappress-google-maps-for-wordpress", "target": "plugin", "versions": "<=2.94.1"}, "RULE-CVE-2024-10715-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:mappress/map[\\\\s\\\\S]{0,4000}?(?:]|on(?:load|error|click|mouseover|focus|mouseenter|mouseout|submit|change|input|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-10715", "description": "MapPress Maps for WordPress <=2.94.1 contributor+ stored XSS via mappress/map Gutenberg block attributes (classic post.php editor submit)", "mode": "block", "severity": 5.4, "slug": "mappress-google-maps-for-wordpress", "target": "plugin", "versions": "<=2.94.1"}, "RULE-CVE-2024-1072-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seedprod_lite_template"}, {"name": "ARGS:id", "type": "equals", "value": "0"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-1072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1072", "description": "SeedProd (Coming Soon) <=6.15.21 missing authorization on seedprod_lite_new_lpage via admin_init", "mode": "block", "severity": 8.2, "slug": "coming-soon", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.15.21"}, "RULE-CVE-2024-10728-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "install_required_plugin"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2024-10728", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10728", "description": "PostX \\u2013 Post Grid Gutenberg Blocks <=4.1.16 missing authorization on install_required_plugin AJAX action allows Subscriber+ arbitrary plugin installation/activation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-post", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=4.1.16"}, "RULE-CVE-2024-10871-01A": {"ajax_action": "get_filter_posts", "conditions": [{"name": "ARGS:params[caf-post-layout]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2024-10871", "method": "POST", "mode": "block", "severity": 9.8, "slug": "category-ajax-filter", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-10871-01B": {"ajax_action": "get_filter_posts", "conditions": [{"name": "ARGS:params[caf-post-layout]", "type": "regex", "value": "~(?i)^(?:php|data|zip|phar)://~"}], "cve": "CVE-2024-10871", "method": "POST", "mode": "block", "severity": 9.8, "slug": "category-ajax-filter", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-10871-01C": {"ajax_action": "get_filter_posts", "conditions": [{"name": "ARGS:params[caf-post-layout]", "type": "regex", "value": "~^(?:/|[A-Za-z]:\\\\\\\\)~"}], "cve": "CVE-2024-10871", "method": "POST", "mode": "block", "severity": 9.8, "slug": "category-ajax-filter", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-10873-01": {"ajax_action": "lakit_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2024-10873", "method": "POST", "mode": "block", "severity": 8.8, "slug": "lastudio-element-kit", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-10873-02": {"ajax_action": "lakit_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2024-10873", "method": "POST", "mode": "block", "severity": 8.8, "slug": "lastudio-element-kit", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-10899-01": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~\\\\[/?[a-zA-Z]~"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated arbitrary shortcode execution via id parameter in wcpt_ajax handler", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["code-injection", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10899-01B": {"action": "init", "conditions": [{"name": "ARGS:wc-ajax", "type": "equals", "value": "wcpt_ajax"}, {"name": "ARGS:id", "type": "regex", "value": "~\\\\[/?[a-zA-Z]~"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated arbitrary shortcode execution via id parameter in wc-ajax wcpt_ajax endpoint", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["code-injection", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10899-02": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[<\\"\']|\\\\b(?:on(?:error|load|click|mouseover|focus)|javascript\\\\s*:)~i"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated reflected XSS via id parameter in wcpt_ajax handler", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10899-02B": {"action": "init", "conditions": [{"name": "ARGS:wc-ajax", "type": "equals", "value": "wcpt_ajax"}, {"name": "ARGS:id", "type": "regex", "value": "~[<\\"\']|\\\\b(?:on(?:error|load|click|mouseover|focus)|javascript\\\\s*:)~i"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated reflected XSS via id parameter in wc-ajax wcpt_ajax endpoint", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10913-01": {"ajax_action": "wpclone-search-n-replace", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 unauthenticated PHP Object Injection - capability gate on search-n-replace AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "missing-authorization", "deserialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10913-02": {"ajax_action": "wpclone-search-n-replace", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 PHP Object Injection via serialized payload in search parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "deserialization", "php-serialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10913-03": {"ajax_action": "wpclone-search-n-replace", "conditions": [{"name": "ARGS:replace", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 PHP Object Injection via serialized payload in replace parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "deserialization", "php-serialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10913-04": {"ajax_action": "wpclone-install_new", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 unauthenticated PHP Object Injection - capability gate on install_new AJAX action (indirect vector via backup restore)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "missing-authorization", "deserialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10924-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/reallysimplessl/v1/two_fa/skip_onboarding(?:/|\\\\?|$)~"}, {"name": "ARGS:user_id", "type": "exists"}], "cve": "CVE-2024-10924", "description": "Really Simple Security >=9.0.0 <=9.1.1.1 unauthenticated authentication bypass via two-factor REST API skip_onboarding endpoint", "mode": "block", "severity": 9.8, "slug": "really-simple-ssl", "target": "plugin", "versions": ">=9.0.0 <=9.1.1.1"}, "RULE-CVE-2024-10932-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~O:[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{|s:[0-9]+:\\"O:[0-9]+:\\\\\\\\\\"[^\\"]+\\\\\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-10932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10932", "description": "Backup Migration <=1.4.6 PHP object injection payload planting via comment content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "backup-backup", "tags": ["object-injection", "deserialization", "comments", "unauthenticated"], "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2024-10932-02": {"ajax_action": "backup_migration", "conditions": [{"name": "ARGS:f", "type": "equals", "value": "startLocalStagingCreation"}, {"name": "ARGS", "type": "regex", "value": "~O:[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{|s:[0-9]+:\\"O:[0-9]+:\\\\\\\\\\"[^\\"]+\\\\\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-10932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10932", "description": "Backup Migration <=1.4.6 PHP object injection via backup_migration staging request payloads", "method": "POST", "mode": "block", "severity": 8.8, "slug": "backup-backup", "tags": ["object-injection", "deserialization", "ajax", "staging"], "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2024-10936-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:O|C):\\\\d+:\\\\\\"~"}], "cve": "CVE-2024-10936", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10936", "description": "String Locator <=2.6.6 unauthenticated PHP Object Injection via comment content planting", "method": "POST", "mode": "block", "severity": 8.8, "slug": "string-locator", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=2.6.6"}, "RULE-CVE-2024-10942-01": {"ajax_action": "ai1wm_import", "conditions": [{"name": "FILES:import:content", "type": "regex", "value": "~[OCa]:[0-9]+:~"}], "cve": "CVE-2024-10942", "description": "All in One WP Migration <=7.89 unauthenticated PHP object injection via backup file import", "mode": "block", "severity": 7.5, "slug": "all-in-one-wp-migration", "target": "plugin", "versions": "<=7.89"}, "RULE-CVE-2024-10960-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^brizy[-_]upload[-_]blocks$~i"}, {"name": "FILES:files", "type": "exists"}], "cve": "CVE-2024-10960", "method": "POST", "mode": "block", "severity": 8.8, "slug": "brizy", "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-10960-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^brizy[-_]upload[-_]layouts$~i"}, {"name": "FILES:files", "type": "exists"}], "cve": "CVE-2024-10960", "method": "POST", "mode": "block", "severity": 8.8, "slug": "brizy", "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-11052-02": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:calculations", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|body|input|object|embed)\\\\b)~i"}], "cve": "CVE-2024-11052", "description": "Ninja Forms <=3.8.19 stored XSS via calculations parameter on nf_ajax_submit unauthenticated handler", "mode": "block", "severity": 6.1, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.8.19"}, "RULE-CVE-2024-11103-01": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:user_id", "type": "regex", "value": "~^\\\\d+$~"}, {"name": "ARGS:pass1", "type": "exists"}], "cve": "CVE-2024-11103", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11103", "description": "Contest Gallery <=24.0.7 unauthenticated arbitrary password reset via post_cg_login AJAX handler (user_id + pass1)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "contest-gallery", "tags": ["authentication-bypass", "privilege-escalation", "account-takeover", "unauthenticated"], "target": "plugin", "versions": "<=24.0.7"}, "RULE-CVE-2024-11103-02": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:cgLostPasswordSiteUrl", "type": "exists"}], "cve": "CVE-2024-11103", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11103", "description": "Contest Gallery <=24.0.7 unauthenticated URL injection in password reset email via cgLostPasswordSiteUrl", "method": "POST", "mode": "block", "severity": 9.8, "slug": "contest-gallery", "tags": ["phishing", "url-injection", "unauthenticated", "weak-password-recovery"], "target": "plugin", "versions": "<=24.0.7"}, "RULE-CVE-2024-11180-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/admin-ajax\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~ekit_countdown_timer_title[^}]*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]*on\\\\w+\\\\s*=|]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-11180", "description": "ElementsKit Elementor Addons <=3.4.7 Stored XSS via Countdown Timer ekit_countdown_timer_title (Elementor AJAX save)", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.4.7"}, "RULE-CVE-2024-11180-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~ekit_countdown_timer_title[^}]*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]*on\\\\w+\\\\s*=|]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-11180", "description": "ElementsKit Elementor Addons <=3.4.7 Stored XSS via Countdown Timer ekit_countdown_timer_title (Elementor REST save)", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.4.7"}, "RULE-CVE-2024-11188-01": {"ajax_action": "frm_forms_preview", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "frm_forms_preview"}, {"name": "ARGS:frm_action", "type": "equals", "value": "preview"}, {"name": "ARGS", "type": "regex", "value": "~]~i"}], "cve": "CVE-2024-11188", "description": "Formidable Forms <=6.16.1.2 stored XSS via form item parameters in preview", "method": "POST", "mode": "block", "severity": 6.5, "slug": "formidable", "tags": ["xss", "stored-xss", "form-builder"], "target": "plugin", "versions": "<=6.16.1.2"}, "RULE-CVE-2024-11270-01": {"ajax_action": "sync-import-imgs", "conditions": [{"type": "missing_capability", "value": "_wswebinar_createwebinars"}], "cve": "CVE-2024-11270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11270", "description": "WebinarPress <=1.33.24 missing authorization on sync-import-imgs AJAX allowing subscriber+ arbitrary file creation (RCE)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-webinarsystem", "tags": ["missing-authorization", "arbitrary-file-upload", "remote-code-execution"], "target": "plugin", "versions": "<=1.33.24"}, "RULE-CVE-2024-11270-02": {"ajax_action": "sync-import-imgs", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2024-11270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11270", "description": "WebinarPress <=1.33.24 arbitrary file upload via sync-import-imgs with executable file extension", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-webinarsystem", "tags": ["arbitrary-file-upload", "remote-code-execution", "file-extension-bypass"], "target": "plugin", "versions": "<=1.33.24"}, "RULE-CVE-2024-11323-01": {"ajax_action": "ai_quiz_update_style", "conditions": [{"name": "ARGS:colors", "type": "exists"}, {"name": "ARGS:colors", "type": "regex", "value": "~[\\"\'](?:default_role|users_can_register|siteurl|home|admin_email|blogname|blogdescription|template|stylesheet|active_plugins|permalink_structure|mailserver_url|hack_file|db_version)[\\"\']\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11323", "description": "AI Quiz <=1.1 authenticated arbitrary options update via ai_quiz_update_style AJAX handler - dangerous option names in colors JSON", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-quiz", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-options-update"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2024-11323-02": {"ajax_action": "ai_quiz_update_style", "conditions": [{"name": "ARGS:colors", "type": "regex", "value": "~<\\\\s*/\\\\s*style|<\\\\s*script|on(?:error|load|click|mouseover)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11323", "description": "AI Quiz <=1.1 authenticated stored XSS via ai_quiz_update_style colors parameter - style tag breakout", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-quiz", "tags": ["missing-authorization", "stored-xss"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2024-11323-03": {"ajax_action": "ai_quiz_update_style", "conditions": [{"name": "ARGS:phrase", "type": "regex", "value": "~<\\\\s*/\\\\s*style|<\\\\s*script|on(?:error|load|click|mouseover)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11323", "description": "AI Quiz <=1.1 authenticated stored XSS via ai_quiz_update_style phrase parameter - style tag breakout", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-quiz", "tags": ["missing-authorization", "stored-xss"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2024-11391-01": {"ajax_action": "fma_load_fma_ui", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "upload"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)|(?:^|\\\\.)user\\\\.ini)$~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-11391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11391", "description": "File Manager Advanced <=5.2.10 Subscriber+ arbitrary file upload via fma_load_fma_ui AJAX action (missing upload_files capability check)", "mode": "block", "severity": 7.5, "slug": "file-manager-advanced", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=5.2.10"}, "RULE-CVE-2024-11391-02": {"ajax_action": "fma_load_shortcode_fma_ui", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "upload"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)|(?:^|\\\\.)user\\\\.ini)$~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-11391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11391", "description": "File Manager Advanced <=5.2.10 Subscriber+ arbitrary file upload via fma_load_shortcode_fma_ui AJAX action (missing upload_files capability check)", "mode": "block", "severity": 7.5, "slug": "file-manager-advanced", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=5.2.10"}, "RULE-CVE-2024-11391-03": {"ajax_action": "fma_load_shortcode_fma_ui", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "upload"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)|(?:^|\\\\.)user\\\\.ini)$~i"}], "cve": "CVE-2024-11391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11391", "description": "File Manager Advanced <=5.2.10 unauthenticated arbitrary file upload via shortcode AJAX nopriv endpoint (CWE-434)", "mode": "block", "severity": 7.5, "slug": "file-manager-advanced", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=5.2.10"}, "RULE-CVE-2024-11415-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-orphanage-extended"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:wporphanageex_role", "type": "regex", "value": "~^(?:administrator|editor|author)$~i"}], "cve": "CVE-2024-11415", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11415", "description": "WP-Orphanage Extended <=1.2 CSRF to orphan account privilege escalation via settings page role parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-orphanage-extended", "tags": ["csrf", "privilege-escalation", "settings-update"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2024-11429-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:stars[_-]testimonials(?:-with-slider-and-masonry-grid)?|testimonial[_-]stars)[^\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|phar://|data://)~i"}], "cve": "CVE-2024-11429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11429", "description": "Stars Testimonials <=3.3.3 Local File Inclusion via shortcode attribute in post_content (post.php)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "stars-testimonials-with-slider-and-masonry-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-11429-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:stars[_-]testimonials(?:-with-slider-and-masonry-grid)?|testimonial[_-]stars)[^\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|phar://|data://)~i"}], "cve": "CVE-2024-11429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11429", "description": "Stars Testimonials <=3.3.3 Local File Inclusion via shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "stars-testimonials-with-slider-and-masonry-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-11582-01": {"ajax_action": "subscribe2_submit", "conditions": [{"name": "ARGS:ip", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|body|object|embed|input|video|audio|source|link|style|meta|form|button|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|focusin|focusout|blur|change|submit|input|toggle|animationend|animationstart|animationiteration|transitionend|pointerover|pointerdown|pointerup|wheel|keydown|keyup|keypress|drag|drop|dragstart|dragend|dragover|copy|paste|cut)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z/+0-9-]*(?:base64|;)|expression\\\\s*\\\\(|%3[Cc](?:script|svg|img|iframe|body)|�*60;?(?:script|svg|img|iframe))~i"}], "cve": "CVE-2024-11582", "description": "Subscribe2 <=10.43 unauthenticated stored XSS via ip parameter on subscribe2_submit AJAX action", "mode": "block", "severity": 7.2, "slug": "subscribe2", "target": "plugin", "versions": "<=10.43"}, "RULE-CVE-2024-11582-02": {"ajax_action": "subscribe2_form", "conditions": [{"name": "ARGS:ip", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|body|object|embed|input|video|audio|source|link|style|meta|form|button|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|focusin|focusout|blur|change|submit|input|toggle|animationend|animationstart|animationiteration|transitionend|pointerover|pointerdown|pointerup|wheel|keydown|keyup|keypress|drag|drop|dragstart|dragend|dragover|copy|paste|cut)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z/+0-9-]*(?:base64|;)|expression\\\\s*\\\\(|%3[Cc](?:script|svg|img|iframe|body)|�*60;?(?:script|svg|img|iframe))~i"}], "cve": "CVE-2024-11582", "description": "Subscribe2 <=10.43 unauthenticated stored XSS via ip parameter on subscribe2_form AJAX action", "mode": "block", "severity": 7.2, "slug": "subscribe2", "target": "plugin", "versions": "<=10.43"}, "RULE-CVE-2024-11642-01": {"ajax_action": "asr_filter_posts", "conditions": [{"name": "ARGS:argsArray[grid_style]", "type": "regex", "value": "~(?:\\\\.{2,}[\\\\\\\\/]{1,}){2,}~"}], "cve": "CVE-2024-11642", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ajax-filter-posts", "target": "plugin", "versions": "<=3.4.11"}, "RULE-CVE-2024-11642-02": {"ajax_action": "asr_filter_posts", "conditions": [{"name": "ARGS:argsArray[filter_style]", "type": "regex", "value": "~(?:\\\\.{2,}[\\\\\\\\/]{1,}){2,}~"}], "cve": "CVE-2024-11642", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ajax-filter-posts", "target": "plugin", "versions": "<=3.4.11"}, "RULE-CVE-2024-11643-01": {"ajax_action": "AllAccessible_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11643", "method": "POST", "mode": "block", "severity": 8.8, "slug": "allaccessible", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2024-1166-01": {"ajax_action": "eihe_top_notice", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2024-1166", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1166", "description": "Image Hover Effects Addon for Elementor <=1.4.1 missing authorization on eihe_top_notice AJAX handler", "mode": "block", "severity": 6.4, "slug": "image-hover-effects-addon-for-elementor", "tags": ["missing-authorization", "csrf"], "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-1168-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:seopress_social_fb_img", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1168", "description": "SEOPress <=7.9 stored XSS via social image URL (seopress_social_fb_img) in post editor metabox", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-seopress", "target": "plugin", "versions": "<=7.9"}, "RULE-CVE-2024-1168-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/seopress/v1/posts/[0-9]+/social-settings(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1168", "description": "SEOPress <=7.9 stored XSS via social image URL through REST API social-settings endpoint", "mode": "block", "severity": 6.4, "slug": "wp-seopress", "target": "plugin", "versions": "<=7.9"}, "RULE-CVE-2024-11689-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:users_can_register", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - users_can_register escalation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "privilege-escalation"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:default_role", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - default_role escalation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "privilege-escalation"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:siteurl", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - siteurl hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:home", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - home URL hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:admin_email", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - admin_email hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "account-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:blogdescription", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - blogdescription defacement", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-defacement"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:permalink_structure", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - permalink_structure manipulation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-defacement"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-08": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:template", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - template/theme hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-09": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:stylesheet", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - stylesheet/theme hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-10": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:active_plugins", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - active_plugins manipulation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-1171-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~eael-filterable-gallery[\\\\s\\\\S]*?(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-11720", "description": "ACF Frontend Form Element <=3.24.5 stored XSS via taxonomy term creation", "mode": "block", "severity": 6.1, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.24.5"}, "RULE-CVE-2024-11720-02": {"ajax_action": "frontend_admin/form_submit", "conditions": [{"name": "ARGS:acffields", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-11720", "description": "ACF Frontend Form Element <=3.24.5 stored XSS via frontend form submission", "mode": "block", "severity": 6.1, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.24.5"}, "RULE-CVE-2024-11720-03": {"ajax_action": "acf/fields/related_terms/add_term", "conditions": [{"name": "ARGS:term", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-11720", "description": "ACF Frontend Form Element <=3.24.5 stored XSS via related terms field", "mode": "block", "severity": 6.1, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.24.5"}, "RULE-CVE-2024-11725-01": {"action": "admin_post_wc_warranty_settings_update", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11725", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sms-alert", "target": "plugin", "versions": "<=3.7.6"}, "RULE-CVE-2024-11731-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ms_slider\\\\b[^\\\\]]*(?:on(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|leave|move)|key(?:up|down|press)|change|submit|input)\\\\s*=|]|javascript\\\\s*:|&#(?:0*(?:10[69]|74|[xX]0*(?:6[Aa9]|4[1a]))|x0*(?:6[Aa]|4[1Aa]));)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-11731", "description": "Master Slider <=3.10.7 stored XSS via ms_slider shortcode class/css_class attributes", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.7"}, "RULE-CVE-2024-11816-01": {"ajax_action": "handle_snippet_update", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:snippet_id", "type": "exists"}, {"name": "ARGS:snippet_code", "type": "exists"}], "cve": "CVE-2024-11816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11816", "description": "WP Extended <=3.0.11 authenticated RCE via missing authorization on handle_snippet_update AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpextended", "tags": ["missing-authorization", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.0.11"}, "RULE-CVE-2024-11848-01": {"ajax_action": "nitropack_dismiss_notice_forever", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11848", "mode": "block", "severity": 8.1, "slug": "nitropack", "target": "plugin", "versions": "<=1.17.0"}, "RULE-CVE-2024-11868-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/lp/v1/material/\\\\d+(?:[/?&]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11868", "method": "GET", "mode": "block", "severity": 5.3, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.7.3"}, "RULE-CVE-2024-11921-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:start-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:end-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:donor", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:start-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:end-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:donor", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]post_type=give_forms~"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-11": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-reports~"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-12": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-tools~"}, {"name": "ARGS:per_page", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-13": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]post_type=give_forms~"}, {"name": "ARGS:start-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-14": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]post_type=give_forms~"}, {"name": "ARGS:end-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11974-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|\\\\?|&)page=mla-menu(?:&|$)~"}, {"name": "ARGS:smc_settings_tab", "type": "regex", "value": "~(?:on(?:click|load|error|mouse(?:over|out|down|up)|focus|blur|change|submit|reset|select|key(?:down|up|press))\\\\s*=|<(?:script|iframe|object|embed|applet|svg|math|link|base|meta|style)|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2024-11974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11974", "description": "Media Library Assistant <=3.23 reflected XSS via smc_settings_tab parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "media-library-assistant", "tags": ["xss", "reflected", "admin"], "target": "plugin", "versions": "<=3.23"}, "RULE-CVE-2024-11974-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|\\\\?|&)page=mla-menu(?:&|$)~"}, {"name": "ARGS:unattachfixit-action", "type": "regex", "value": "~(?:on(?:click|load|error|mouse(?:over|out|down|up)|focus|blur|change|submit|reset|select|key(?:down|up|press))\\\\s*=|<(?:script|iframe|object|embed|applet|svg|math|link|base|meta|style)|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2024-11974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11974", "description": "Media Library Assistant <=3.23 reflected XSS via unattachfixit-action parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "media-library-assistant", "tags": ["xss", "reflected", "admin"], "target": "plugin", "versions": "<=3.23"}, "RULE-CVE-2024-11974-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|\\\\?|&)page=mla-menu(?:&|$)~"}, {"name": "ARGS:woofixit-action", "type": "regex", "value": "~(?:on(?:click|load|error|mouse(?:over|out|down|up)|focus|blur|change|submit|reset|select|key(?:down|up|press))\\\\s*=|<(?:script|iframe|object|embed|applet|svg|math|link|base|meta|style)|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2024-11974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11974", "description": "Media Library Assistant <=3.23 reflected XSS via woofixit-action parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "media-library-assistant", "tags": ["xss", "reflected", "admin"], "target": "plugin", "versions": "<=3.23"}, "RULE-CVE-2024-1203-01": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:valueData", "type": "regex", "value": "~(?:\'\\\\s*(?:OR|AND)\\\\b|\\\\b(?:OR|AND)\\\\s+\\\\d+=\\\\d+|UNION\\\\s+SELECT|SELECT\\\\s+.+\\\\s+FROM|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|--\\\\s*$|/\\\\*|;\\\\s*(?:DROP|ALTER|INSERT|UPDATE|DELETE)\\\\b)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via valueData in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-02": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:conditionData", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via conditionData in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-03": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:productArray", "type": "detectSQLi"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+SELECT|SELECT\\\\s+.+\\\\s+FROM|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|OR\\\\s+\\\\d+=\\\\d+|AND\\\\s+\\\\d+=\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+\'|--\\\\s*$|;\\\\s*(?:DROP|ALTER|INSERT|UPDATE|DELETE))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via productArray in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-04": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:exclude", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via exclude in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-05": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:include", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via include in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-12040-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\.\\\\\\\\)[^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) Local File Inclusion via [wcpcsu] shortcode theme attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-12040-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?(?:php|data|expect|zip|phar)://~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) Local File Inclusion via [wcpcsu] shortcode theme attribute with PHP wrapper in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "php-wrapper", "shortcode"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-12040-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\.\\\\\\\\)[^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) LFI via REST API post content with [wcpcsu] shortcode theme traversal", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-12040-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?(?:php|data|expect|zip|phar)://~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) LFI via REST API post content with [wcpcsu] shortcode theme PHP wrapper", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "php-wrapper", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-1206-01": {"ajax_action": "wprm_import_recipes", "conditions": [{"name": "ARGS:recipes", "type": "regex", "value": "~[^0-9,\\\\s]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1206", "description": "WP Recipe Maker <=9.1.2 authenticated SQL injection via recipes parameter (scalar) in wprm_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-recipe-maker", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2024-1206-02": {"ajax_action": "wprm_import_recipes", "conditions": [{"name": "ARGS:recipes[0]", "type": "regex", "value": "~[^0-9,\\\\s]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1206", "description": "WP Recipe Maker <=9.1.2 authenticated SQL injection via recipes[] array element in wprm_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-recipe-maker", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2024-1207-01": {"ajax_action": "WPBC_AJX_CALENDAR_LOAD", "conditions": [{"name": "ARGS:calendar_request_params[dates_ddmmyy_csv]", "type": "regex", "value": "~[^0-9.,\\\\-\\\\s;]~"}], "cve": "CVE-2024-1207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1207", "description": "WP Booking Calendar <=9.9 unauthenticated SQL injection via calendar_request_params[dates_ddmmyy_csv] in WPBC_AJX_CALENDAR_LOAD", "method": "POST", "mode": "block", "severity": 9.8, "slug": "booking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=9.9"}, "RULE-CVE-2024-1207-02": {"ajax_action": "WPBC_AJX_BOOKING__CREATE", "conditions": [{"name": "ARGS:calendar_request_params[dates_ddmmyy_csv]", "type": "regex", "value": "~[^0-9.,\\\\-\\\\s;]~"}], "cve": "CVE-2024-1207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1207", "description": "WP Booking Calendar <=9.9 unauthenticated SQL injection via calendar_request_params[dates_ddmmyy_csv] in WPBC_AJX_BOOKING__CREATE", "method": "POST", "mode": "block", "severity": 9.8, "slug": "booking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=9.9"}, "RULE-CVE-2024-12171-01": {"ajax_action": "eh_crm_agent_add_user", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12171", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elex-helpdesk-customer-support-ticket-system", "target": "plugin", "versions": "<=3.2.6"}, "RULE-CVE-2024-12184-01": {"ajax_action": "accua_forms_download_submitted_file", "conditions": [{"name": "ARGS:subid", "type": "exists"}, {"name": "ARGS:field", "type": "exists"}, {"name": "ARGS:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12184", "mode": "block", "slug": "contact-forms", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2024-12238-01": {"ajax_action": "nf_preview_update", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-12238", "description": "Ninja Forms <=3.8.22 authenticated (subscriber+) arbitrary shortcode execution via nf_preview_update AJAX action (do_shortcode on attacker-controlled preview content in includes/Display/Preview.php)", "mode": "block", "severity": 6.3, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.8.22"}, "RULE-CVE-2024-12259-01": {"ajax_action": "wc_update_user_data", "conditions": [{"name": "ARGS:update_user", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12259", "method": "POST", "mode": "block", "severity": 8.8, "slug": "computer-repair-shop", "target": "plugin", "versions": "<=3.8120"}, "RULE-CVE-2024-12264-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/payu/v1/get-shipping-cost(?:[/?&]|$)~"}, {"name": "ARGS:username", "type": "exists"}], "cve": "CVE-2024-12264", "method": "POST", "mode": "block", "severity": 9.8, "slug": "payu-india", "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2024-12264-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/payu/v1/get-shipping-cost(?:[/?&]|$)~"}, {"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2024-12264", "method": "POST", "mode": "block", "severity": 9.8, "slug": "payu-india", "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2024-12264-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/payu/v1/generate-user-token(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12264", "method": "POST", "mode": "block", "severity": 9.8, "slug": "payu-india", "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2024-12272-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\bphp://|\\\\bphar://|\\\\bdata://|\\\\bzip://|\\\\bglob://|\\\\bexpect://|\\\\bfile://|\\\\bftp://|\\\\bhttps?://|\\\\bcompress\\\\.(?:zlib|bzip2)://|\\\\bssh2\\\\.(?:sftp|scp)://|\\\\bogg://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-12272", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12272", "description": "WP Travel Engine Elementor Widgets <=1.3.7 authenticated local file inclusion attempt via wp-admin post.php content save (traversal/wrapper signatures)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wte-elementor-widgets", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2024-12272-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\bphp://|\\\\bphar://|\\\\bdata://|\\\\bzip://|\\\\bglob://|\\\\bexpect://|\\\\bfile://|\\\\bftp://|\\\\bhttps?://|\\\\bcompress\\\\.(?:zlib|bzip2)://|\\\\bssh2\\\\.(?:sftp|scp)://|\\\\bogg://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-12272", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12272", "description": "WP Travel Engine Elementor Widgets <=1.3.7 authenticated local file inclusion attempt via elementor_ajax editor requests (traversal/wrapper signatures)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wte-elementor-widgets", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2024-12293-01": {"ajax_action": "ure_ajax", "conditions": [{"name": "ARGS:role", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2024-12293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12293", "description": "User Role Editor <=4.64.3 CSRF to privilege escalation via ure_ajax role update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "user-role-editor", "tags": ["csrf", "privilege-escalation", "missing-authorization"], "target": "plugin", "versions": "<=4.64.3"}, "RULE-CVE-2024-12304-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/singlebtn[^}]*\\"link\\"\\\\s*:\\\\s*\\"(?:javascript\\\\s*:|[^\\"]*(?:on(?:error|load|mouseover|click|focus)\\\\s*=|<\\\\s*script))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-12304", "description": "Kadence Blocks <=3.4.2 contributor+ stored XSS via singlebtn block link attribute (REST API)", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2024-12304-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/singlebtn[^}]*\\"link\\"\\\\s*:\\\\s*\\"(?:javascript\\\\s*:|[^\\"]*(?:on(?:error|load|mouseover|click|focus)\\\\s*=|<\\\\s*script))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-12304", "description": "Kadence Blocks <=3.4.2 contributor+ stored XSS via singlebtn block link attribute (classic editor)", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2024-12322-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "theperfectweddingnl-widget/tpw.php"}, {"name": "ARGS:tpwKey", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-12599", "description": "HT Mega Addons for Elementor <=2.8.1 contributor+ stored XSS via Countdown widget attributes", "mode": "block", "severity": 6.4, "slug": "ht-mega-for-elementor", "target": "plugin", "versions": "<=2.8.1"}, "RULE-CVE-2024-12635-01": {"ajax_action": "wpdocs_update_folder", "conditions": [{"name": "ARGS:dir_id", "type": "detectSQLi"}], "cve": "CVE-2024-12635", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2024-12635-02": {"ajax_action": "wpdocs_delete_folder", "conditions": [{"name": "ARGS:dir_id", "type": "detectSQLi"}], "cve": "CVE-2024-12635", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2024-12635-03": {"ajax_action": "wpdocs_delete_files", "conditions": [{"name": "ARGS:dir_id", "type": "detectSQLi"}], "cve": "CVE-2024-12635", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2024-1276-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "detectXSS"}], "cve": "CVE-2024-1276", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.8"}, "RULE-CVE-2024-12771-01": {"ajax_action": "customer_panel_password_reset", "conditions": [{"name": "ARGS:new_password", "type": "exists"}, {"name": "ARGS:repeat_new_password", "type": "exists"}], "cve": "CVE-2024-12771", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ecommerce-product-catalog", "target": "plugin", "versions": "<=3.3.43"}, "RULE-CVE-2024-1278-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[efb_likebox\\\\b[^\\\\]]*(?:on(?:load|error|click|mouseover|focus|blur|mouseout|mousedown|mouseup|keydown|keyup|keypress|submit|change|input)\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b[^>]*on|<\\\\s*img\\\\b[^>]*on|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-1278", "description": "Easy Facebook Likebox <=6.5.4 contributor+ stored XSS via efb_likebox shortcode attributes in post content (classic editor save)", "mode": "block", "severity": 5.4, "slug": "easy-facebook-likebox", "target": "plugin", "versions": "<=6.5.4"}, "RULE-CVE-2024-1278-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[efb_likebox\\\\b[^\\\\]]*(?:on(?:load|error|click|mouseover|focus|blur|mouseout|mousedown|mouseup|keydown|keyup|keypress|submit|change|input)\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b[^>]*on|<\\\\s*img\\\\b[^>]*on|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-1278", "description": "Easy Facebook Likebox <=6.5.4 contributor+ stored XSS via efb_likebox shortcode attributes in REST post create/update", "mode": "block", "severity": 5.4, "slug": "easy-facebook-likebox", "target": "plugin", "versions": "<=6.5.4"}, "RULE-CVE-2024-12853-01": {"ajax_action": "modula_unzip_file", "conditions": [{"name": "ARGS:fileID", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12853", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12853", "description": "Modula Image Gallery <=2.11.10 arbitrary file upload via missing ZIP entry file-type validation in modula_unzip_file AJAX handler", "mode": "block", "severity": 8.8, "slug": "modula-best-grid-gallery", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.11.10"}, "RULE-CVE-2024-12875-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/post.php"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "download"}, {"name": "ARGS:/^edd_download_files$/", "type": "regex", "value": "~(?i)(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|%252e%252e%255c|\\\\.\\\\.\\\\.\\\\.//)~i"}], "cve": "CVE-2024-12875", "method": "POST", "mode": "block", "severity": 4.9, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-12877-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:firstName", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:lastName", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-04": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:form_id", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-05": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:gateway", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12881-01": {"ajax_action": "eos_plugin_reviews_restore_version", "conditions": [{"name": "ARGS:dir", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12881", "method": "POST", "mode": "block", "severity": 8.8, "slug": "plugversions", "target": "plugin", "versions": "<=0.0.7"}, "RULE-CVE-2024-1289-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:profile|user-profile)/[^/]+/orders/.*~"}, {"name": "ARGS:view-order", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1289", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.3"}, "RULE-CVE-2024-12919-01": {"action": "init", "conditions": [{"name": "ARGS:pms_payment_id", "type": "regex", "value": "~^0*[1-9][0-9]*$~"}, {"name": "ARGS:pms_autologin_before_redirect", "type": "equals", "value": "true"}], "cve": "CVE-2024-12919", "mode": "block", "severity": 9.8, "slug": "paid-member-subscriptions", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-12922-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "pp_import_current"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12922", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12922", "description": "Altair <=5.2.4 - unauthenticated arbitrary options update via the pp_import_current AJAX action. The handler is registered on both wp_ajax_ and wp_ajax_nopriv_ and performs no capability check and no nonce check, so any caller can write arbitrary options - default_role and users_can_register for privilege escalation, siteurl for redirect hijack, and anything else. The vulnerability is the missing authorization on the endpoint, not any particular option value, so this rule gates on the capability the handler should have required: it fires when a caller without manage_options invokes the action. Do not add conditions on the option names or values. Doing so reintroduces the original defect - an earlier revision required users_can_register == 1 AND an admin-like default_role together, which matched none of the seven attack cases in the corpus (each sends only one option) while a legitimate administrator sending default_role=subscriber is allowed by the capability check alone.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "altair", "target": "theme", "versions": "<=5.2.4"}, "RULE-CVE-2024-13127-01": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/lp/v1/settings~i"}], "cve": "CVE-2024-13127", "description": "Broken access control allows non-admin users to modify LearnPress display settings via REST API", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.7.5"}, "RULE-CVE-2024-13128-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~i"}, {"name": "ARGS:page", "type": "equals", "value": "learn-press-settings"}, {"name": "ARGS:primary_color", "type": "detectXSS"}, {"name": "ARGS:secondary_color", "type": "detectXSS"}, {"name": "ARGS:width_container", "type": "detectXSS"}, {"name": "ARGS:learn_press[primary_color]", "type": "detectXSS"}, {"name": "ARGS:learn_press[secondary_color]", "type": "detectXSS"}, {"name": "ARGS:learn_press[width_container]", "type": "detectXSS"}], "cve": "CVE-2024-13128", "description": "Broken access control allows non-admin users to modify LearnPress color settings via REST API", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.7.5"}, "RULE-CVE-2024-1315-01": {"ajax_action": "rtcl_update_user_account", "conditions": [{"name": "ARGS:email", "type": "exists"}, {"name": "ARGS:pass1", "type": "exists"}], "cve": "CVE-2024-1315", "method": "POST", "mode": "block", "severity": 8.8, "slug": "classified-listing", "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2024-1317-01": {"ajax_action": "feedzy", "conditions": [{"name": "ARGS:search_key", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1317", "method": "POST", "mode": "block", "severity": 8.8, "slug": "feedzy-rss-feeds", "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2024-13183-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"title_tag\\"\\\\s*:\\\\s*\\"(?!(?:h[1-6]|p)\\")[^\\"]*(?:[<>\\"=/\\\\s]|on[a-z]+\\\\s*=|javascript\\\\s*:|script|svg|iframe|img|onerror|onload|onmouseover)~i"}], "cve": "CVE-2024-13183", "description": "Orbit Fox by ThemeIsle (themeisle-companion) <=2.10.43 contributor+ stored XSS via Pricing Table widget title_tag parameter", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2024-13183-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"subtitle_tag\\"\\\\s*:\\\\s*\\"(?!(?:h[1-6]|p)\\")[^\\"]*(?:[<>\\"=/\\\\s]|on[a-z]+\\\\s*=|javascript\\\\s*:|script|svg|iframe|img|onerror|onload|onmouseover)~i"}], "cve": "CVE-2024-13183", "description": "Orbit Fox by ThemeIsle (themeisle-companion) <=2.10.43 contributor+ stored XSS via Pricing Table widget subtitle_tag parameter", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2024-13227-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/rank-math(/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-13227", "mode": "block", "severity": 5.4, "slug": "seo-by-rank-math", "target": "plugin", "versions": "<=1.0.235"}, "RULE-CVE-2024-13227-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/rank-math(/|\\\\?|$)~"}, {"name": "ARGS:is_new", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-13227", "mode": "block", "severity": 5.4, "slug": "seo-by-rank-math", "target": "plugin", "versions": "<=1.0.235"}, "RULE-CVE-2024-13315-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "shopwarden"}, {"name": "ARGS:action", "type": "equals", "value": "save_setting"}, {"name": "ARGS:key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-13315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13315", "description": "Shopwarden <=1.0.11 CSRF to arbitrary WordPress options update via admin.php page=shopwarden action=save_setting", "mode": "block", "severity": 8.8, "slug": "shopwarden", "tags": ["csrf", "broken-access-control", "options-update", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.11"}, "RULE-CVE-2024-13353-01": {"ajax_action": "rael_products_pagination_product", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|zip|phar|data|expect|glob)://)~i"}], "cve": "CVE-2024-13353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13353", "description": "Responsive Addons for Elementor <=1.6.4 Local File Inclusion via template parameter in rael_products_pagination_product AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2024-13353-02": {"ajax_action": "rael_woo_product_pagination", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|zip|phar|data|expect|glob)://)~i"}], "cve": "CVE-2024-13353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13353", "description": "Responsive Addons for Elementor <=1.6.4 Local File Inclusion via template parameter in rael_woo_product_pagination AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2024-13353-03": {"ajax_action": "rael_load_more", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|zip|phar|data|expect|glob)://)~i"}], "cve": "CVE-2024-13353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13353", "description": "Responsive Addons for Elementor <=1.6.4 Local File Inclusion via template parameter in rael_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2024-13362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~freemius-pricing\\\\.js~"}, {"name": "ARGS:url", "type": "regex", "value": "~(]|<[^>]+on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-13757", "description": "Master Slider <=3.10.6 stored XSS via ms_layer shortcode effect attribute in post content", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.6"}, "RULE-CVE-2024-13784-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "arforms_paypal_response"}, {"name": "ARGS:custom", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-13784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13784", "description": "ARForms Form Builder <=1.8.5 unauthenticated PHP object injection via custom parameter in PayPal IPN response handler (page=arforms_paypal_response)", "mode": "block", "severity": 9.8, "slug": "arforms-form-builder", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2024-13784-02": {"action": "init", "conditions": [{"name": "ARGS:arf_page", "type": "equals", "value": "arforms_paypal_response"}, {"name": "ARGS:custom", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-13784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13784", "description": "ARForms Form Builder <=1.8.5 unauthenticated PHP object injection via custom parameter in PayPal IPN response handler (arf_page=arforms_paypal_response)", "mode": "block", "severity": 9.8, "slug": "arforms-form-builder", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2024-13789-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/__ravpage/api([#?]|$)~"}, {"name": "ARGS:paramsv2", "type": "regex", "value": "~(?:Tzo|Qzo)~"}], "cve": "CVE-2024-13789", "mode": "block", "severity": 9.8, "slug": "ravpage", "target": "plugin", "versions": "<=2.31"}, "RULE-CVE-2024-13803-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~essential-blocks/[a-z-]+[^}]*[\\"\']dataMarker[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|\\\\s*]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|\\\\s*]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1409", "description": "ProfilePress <=4.15.0 contributor+ stored XSS via [reg-select-role] shortcode default_role attribute", "mode": "block", "severity": 6.4, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.15.0"}, "RULE-CVE-2024-1424-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1424-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1424-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1424-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1463-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "accept-request"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2024-1463", "method": "GET", "mode": "block", "severity": 4.8, "slug": "learnpress", "target": "plugin", "versions": "<4.2.6.4"}, "RULE-CVE-2024-1463-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "deny-request"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2024-1463", "method": "GET", "mode": "block", "severity": 4.8, "slug": "learnpress", "target": "plugin", "versions": "<4.2.6.4"}, "RULE-CVE-2024-1497-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~addr2_width[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1497", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via addr2_width widget attribute in Elementor AJAX save", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1497-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~addr2_width[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1497", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via addr2_width widget attribute in Elementor REST API save", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1499-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~title_tags[^}]*(?:on(?:mouse(?:over|enter|move|down|up)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|animation(?:start|end|iteration)|transition(?:end|run|start)|change|input|submit|resize|scroll|contextmenu|pointerdown|pointermove|pointerup|pointerenter|pointerleave|touchstart|touchmove|touchend|wheel|drag(?:start|end|over|enter|leave)?|drop|copy|cut|paste)\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|form|base|link|meta|style)\\\\b|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1499", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via Pricing Table widget title_tags parameter", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1499-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v\\\\d+/document(/|\\\\?|$)~"}, {"name": "ARGS:actions", "type": "regex", "value": "~title_tags[^}]*(?:on(?:mouse(?:over|enter|move|down|up)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|animation(?:start|end|iteration)|transition(?:end|run|start)|change|input|submit|resize|scroll|contextmenu|pointerdown|pointermove|pointerup|pointerenter|pointerleave|touchstart|touchmove|touchend|wheel|drag(?:start|end|over|enter|leave)?|drop|copy|cut|paste)\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|form|base|link|meta|style)\\\\b|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1499", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via Pricing Table widget title_tags parameter (REST API vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1510-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_tooltip\\\\b[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1510", "description": "Shortcodes Ultimate <=7.0.2 contributor+ stored XSS via su_tooltip shortcode attributes in post content", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.2"}, "RULE-CVE-2024-1510-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_tooltip\\\\b[^\\\\]]*tag\\\\s*=\\\\s*[\\"\']?(?:script|img|iframe|svg|object|embed|details|body|marquee|video|audio|math)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1510", "description": "Shortcodes Ultimate <=7.0.2 contributor+ stored XSS via su_tooltip tag attribute injection in post content", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.2"}, "RULE-CVE-2024-1512-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lms/stm-lms/order/items(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user", "type": "detectSQLi"}], "cve": "CVE-2024-1512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1512", "description": "MasterStudy LMS <=3.2.5 unauthenticated SQL injection via user parameter in /stm-lms/order/items REST endpoint", "method": "GET", "mode": "block", "severity": 9.8, "slug": "masterstudy-lms-learning-management-system", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.2.5"}, "RULE-CVE-2024-1535-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[profilepress-(?:registration|edit-profile|login|user-profile|melange|member-directory|my-account)\\\\b[^\\\\]]*(?:on(?:focus|blur|click|error|load|mouseover|animationstart|animationend|transitionend|pointerover)\\\\s*=|javascript\\\\s*:|<\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1535", "description": "ProfilePress <=4.15.2 contributor+ stored XSS via shortcode attribute injection in REST API post content", "mode": "block", "severity": 6.4, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.15.2"}, "RULE-CVE-2024-1536-01A": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\\\\\"widgetType\\\\\\"\\\\s*:\\\\s*\\\\\\"eael-event-calendar\\\\\\"~"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\\\\\"eael_event_(?:calendar_first_day|details_link_hide)\\\\\\"\\\\s*:\\\\s*\\\\\\"\\\\\\\\\\\\\\"\\\\s+on[a-z]+\\\\s*=~"}], "cve": "CVE-2024-1536", "method": "POST", "mode": "block", "severity": 7.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2024-1536-01B": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\\\\\"widgetType\\\\\\"\\\\s*:\\\\s*\\\\\\"eael-event-calendar\\\\\\"~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\\\\\"eael_event_(?:calendar_first_day|details_link_hide)\\\\\\"\\\\s*:\\\\s*\\\\\\"\\\\\\\\\\\\\\"\\\\s+on[a-z]+\\\\s*=~"}], "cve": "CVE-2024-1536", "method": "POST", "mode": "block", "severity": 7.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2024-1537-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}~"}], "cve": "CVE-2024-1537", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2024-1570-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[\\\\s*login-password\\\\b[^\\\\]]*\\\\btitle\\\\s*=\\\\s*(?:\\"[^\\"]*(?:(?:"|%22|\\")\\\\s*(?:on[a-z]+|style|formaction)\\\\s*=|javascript\\\\s*:|]|on(?:load|error|click|mouseover|focus|blur|input|submit|change|toggle|animationend)\\\\s*=|javascript\\\\s*:|srcdoc\\\\s*=|formaction\\\\s*=|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-1582", "description": "WP Go Maps (formerly WP Google Maps) <=9.0.32 contributor+ stored XSS via wpgmza shortcode attributes in post content", "mode": "block", "severity": 5.4, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.32"}, "RULE-CVE-2024-1685-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "save_button"}, {"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in save_button handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1685-02": {"ajax_action": "import_buttons", "conditions": [{"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in import_buttons AJAX handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1685-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "export_button"}, {"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in export_button handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1685-04": {"ajax_action": "clone_button", "conditions": [{"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in clone_button AJAX handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1698-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/notificationx/v1/analytics(?:/|\\\\?|&|$)~"}, {"name": "ARGS:type", "type": "detectSQLi"}], "cve": "CVE-2024-1698", "mode": "block", "severity": 9.8, "slug": "notificationx", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-1710-01": {"ajax_action": "unitecreator_ajax_action", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^unitecreator_ajax_action$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1710", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1710", "description": "Addon Library <=1.3.76 missing authorization on AJAX handler allows subscriber+ arbitrary actions including file upload", "method": "POST", "mode": "block", "severity": 8.8, "slug": "addon-library", "tags": ["missing-authorization", "arbitrary-file-upload", "broken-access-control"], "target": "plugin", "versions": "<=1.3.76"}, "RULE-CVE-2024-1711-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/(?:mv-create|mediavine-create)/v1/creations(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-1711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1711", "description": "Create by Mediavine <=1.9.4 unauthenticated SQL injection via id parameter in creations REST route", "method": "GET", "mode": "block", "severity": 9.8, "slug": "mediavine-create", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2024-1711-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/(?:mv-create|mediavine-create)/v1/products(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-1711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1711", "description": "Create by Mediavine <=1.9.4 unauthenticated SQL injection via id parameter in products REST route", "method": "GET", "mode": "block", "severity": 9.8, "slug": "mediavine-create", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2024-1711-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/(?:mv-create|mediavine-create)/v1/images(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-1711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1711", "description": "Create by Mediavine <=1.9.4 unauthenticated SQL injection via id parameter in images REST route", "method": "GET", "mode": "block", "severity": 9.8, "slug": "mediavine-create", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2024-1711-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/(?:mv-create|mediavine-create)/v1/nutrition(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-1711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1711", "description": "Create by Mediavine <=1.9.4 unauthenticated SQL injection via id parameter in nutrition REST route", "method": "GET", "mode": "block", "severity": 9.8, "slug": "mediavine-create", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2024-1711-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/(?:mv-create|mediavine-create)/v1/product-maps(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-1711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1711", "description": "Create by Mediavine <=1.9.4 unauthenticated SQL injection via id parameter in product-maps REST route", "method": "GET", "mode": "block", "severity": 9.8, "slug": "mediavine-create", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2024-1723-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages))~"}, {"name": "ARGS:widget-sow-headline[instance][headline_tag]", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]|[\\"\']>)~i"}], "cve": "CVE-2024-1723", "description": "SiteOrigin Widgets Bundle <=1.58.7 authenticated reflected XSS via postId in so_widgets_links_get_title", "mode": "block", "severity": 6.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.58.7"}, "RULE-CVE-2024-1751-01": {"ajax_action": "tutor_qna_single_action", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "tutor_qna_single_action"}, {"name": "ARGS:question_id", "type": "detectSQLi"}], "cve": "CVE-2024-1751", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1751", "description": "Tutor LMS <=2.6.1 authenticated SQL injection via question_id in tutor_qna_single_action AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=2.6.1"}, "RULE-CVE-2024-1751-02": {"ajax_action": "tutor_q_and_a_load_more", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "tutor_q_and_a_load_more"}, {"name": "ARGS:question_id", "type": "detectSQLi"}], "cve": "CVE-2024-1751", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1751", "description": "Tutor LMS <=2.6.1 authenticated SQL injection via question_id in tutor_q_and_a_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=2.6.1"}, "RULE-CVE-2024-1755-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "nps-plugin-options"}, {"name": "ARGS:event", "type": "equals", "value": "delete_all"}], "cve": "CVE-2024-1755", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nps-computy", "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2024-1755-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "nps-plugin-options"}, {"name": "ARGS:event", "type": "equals", "value": "delete"}, {"name": "ARGS:id", "type": "regex", "value": "~^[0-9]+$~i"}], "cve": "CVE-2024-1755", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nps-computy", "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2024-1762-01": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:User-Agent", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|body|object|embed|video|audio|details|marquee|input|form|style|link|meta|base|math|a)\\\\b|\\\\bon(?:load|error|click|mouseover|mouseout|focus|blur|toggle|animationstart|animationend|animationiteration|input|change|submit|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:|srcdoc\\\\s*=|data\\\\s*:\\\\s*text/html|%3C\\\\s*(?:script|svg|img|iframe)|&#x?0*(?:3c|60)\\\\s*;?\\\\s*(?:script|svg|img))~i"}], "cve": "CVE-2024-1762", "description": "NextScripts Social Networks Auto-Poster <=4.4.3 unauthenticated stored XSS via HTTP User-Agent header persisted into NXS_cronCheck option and rendered on admin cron test page", "mode": "block", "severity": 6.1, "slug": "social-networks-auto-poster-facebook-twitter-g", "target": "plugin", "versions": "<=4.4.3"}, "RULE-CVE-2024-1770-01": {"action": "admin_init", "conditions": [{"name": "ARGS:mtm_tags[0]", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1770", "method": "POST", "mode": "block", "severity": 8.8, "slug": "meta-tag-manager", "target": "plugin", "versions": "<3.1"}, "RULE-CVE-2024-1775-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:error_description", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|\\\\beval\\\\b|\\\\balert\\\\()~i"}], "cve": "CVE-2024-1775", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1775", "description": "Nextend Facebook Connect <=3.1.12 reflected XSS via error_description OAuth parameter", "method": "GET", "mode": "block", "severity": 5.4, "slug": "nextend-facebook-connect", "tags": ["xss", "reflected", "oauth", "authenticated"], "target": "plugin", "versions": "<=3.1.12"}, "RULE-CVE-2024-1794-01": {"ajax_action": "forminator_multiple_file_upload", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "forminator_multiple_file_upload"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|3gpp?|svg)$~i"}], "cve": "CVE-2024-1794", "description": "Forminator <=1.29.0 unauthenticated stored XSS via multiple file upload", "mode": "block", "severity": 6.1, "slug": "forminator", "target": "plugin", "versions": "<=1.29.0"}, "RULE-CVE-2024-1797-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|/wp-admin/admin-ajax\\\\.php)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_ulike(?:_counter)?\\\\s[^\\\\]]*(?:id|status)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\'|--|;|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP\\\\s*\\\\(|BENCHMARK|EXTRACTVALUE|CONCAT\\\\s*\\\\(|information_schema|/\\\\*)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1797", "description": "WP ULike <=4.6.9 authenticated (Contributor+) SQL injection via wp_ulike/wp_ulike_counter shortcode attributes in post content submitted to post.php", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-ulike", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.6.9"}, "RULE-CVE-2024-1797-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_ulike(?:_counter)?\\\\s[^\\\\]]*(?:id|status)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\'|--|;|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP\\\\s*\\\\(|BENCHMARK|EXTRACTVALUE|CONCAT\\\\s*\\\\(|information_schema|/\\\\*)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1797", "description": "WP ULike <=4.6.9 authenticated (Contributor+) SQL injection via wp_ulike/wp_ulike_counter shortcode attributes in post content submitted to REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-ulike", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.6.9"}, "RULE-CVE-2024-1806-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:profilepress-edit-profile|profilepress-login|profilepress-password-reset|profilepress-melange-password-reset|ppress_content_condition)\\\\s[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1806", "description": "ProfilePress <=4.15.1 stored XSS via shortcode attributes in post content", "mode": "block", "severity": 6.4, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.15.1"}, "RULE-CVE-2024-1808-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_qrcode[^\\\\]]*?(?:\\\\b(?:placeholder|alt|title|content)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)|(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)))~i"}], "cve": "CVE-2024-1808", "description": "Shortcodes Ultimate <=7.0.3 contributor+ stored XSS via su_qrcode shortcode attributes (placeholder, alt, title, content) on post save", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2024-1808-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_qrcode[^\\\\]]*?(?:\\\\b(?:placeholder|alt|title|content)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)|(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)))~i"}], "cve": "CVE-2024-1808", "description": "Shortcodes Ultimate <=7.0.3 contributor+ stored XSS via su_qrcode shortcode in REST API post content", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2024-1808-03": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[su_qrcode[^\\\\]]*?(?:\\\\b(?:placeholder|alt|title|content)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)|(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)))~i"}], "cve": "CVE-2024-1808", "description": "Shortcodes Ultimate <=7.0.3 reflected XSS via su_qrcode in su_generator_preview AJAX shortcode parameter", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2024-1815-01": {"ajax_action": "uag_load_image_gallery_masonry", "conditions": [{"name": "ARGS:attr[paginateArrow]", "type": "detectXSS"}], "cve": "CVE-2024-1815", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.12.8"}, "RULE-CVE-2024-1815-02": {"ajax_action": "uag_load_image_gallery_grid_pagination", "conditions": [{"name": "ARGS:attr[captionDisplayType]", "type": "detectXSS"}], "cve": "CVE-2024-1815", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.12.8"}, "RULE-CVE-2024-1843-01": {"ajax_action": "ast_block_templates_importer", "conditions": [{"name": "ARGS:api_uri", "type": "regex", "value": "~(^(file|gopher|dict|ftp)://|^https?://([^@]*@)?(127\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[::1\\\\])(:[0-9]+)?(/|$|\\\\?))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1843", "description": "Spectra <=2.6.6 SSRF via block templates importer allowing internal network access", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ultimate-addons-for-gutenberg", "tags": ["ssrf", "broken-access-control"], "target": "plugin", "versions": "<=2.6.6"}, "RULE-CVE-2024-1859-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "slider_responsive"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-1859", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1859", "description": "Slider Responsive Slideshow <=1.3.8 authenticated (Contributor+) PHP Object Injection via save_post slider data", "method": "POST", "mode": "block", "severity": 8.8, "slug": "slider-responsive-slideshow", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2024-1974-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.|%2e){2}(?:%2f|%5c|[\\\\\\\\/])+){2,}~i"}], "cve": "CVE-2024-1974", "method": "POST", "mode": "block", "severity": 6.5, "slug": "ht-mega-for-elementor", "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-1981-01": {"ajax_action": "wpvividstg_start_staging_free", "conditions": [{"name": "ARGS:table_prefix", "type": "exists"}, {"name": "ARGS:table_prefix", "type": "regex", "value": "~[\'\\"`;]|--|#|(?i)\\\\bunion\\\\b|(?i)\\\\bselect\\\\b~"}], "cve": "CVE-2024-1981", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-01": {"ajax_action": "wpvivid_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-02": {"ajax_action": "wpvivid_get_restore_progress", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-03": {"ajax_action": "wpvividstg_start_staging_free", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-04": {"ajax_action": "wpvividstg_get_staging_progress_free", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1990-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-02a": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-02b": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-02c": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PATCH", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-03a": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-03b": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-03c": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PATCH", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1991-01": {"ajax_action": "rm_update_users_role", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1991", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.0.0"}, "RULE-CVE-2024-2006-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "pgcu_shortcode"}, {"name": "ARGS", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2024-2006", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-grid-carousel-ultimate", "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2024-2008-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php~"}, {"name": "ARGS:meta_input[/awl_mpb_settings_[0-9]+/]", "type": "regex", "value": "~(?:^|[^A-Za-z0-9+/=])(Tzo|Qzo)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2008", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2008", "description": "Modal Popup Box <=1.5.2 authenticated PHP Object Injection via shortcode meta", "method": "POST", "mode": "block", "severity": 8.8, "slug": "modal-popup-box", "tags": ["object-injection", "php-deserialization"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2024-2025-01": {"ajax_action": "wc4bp_add_page", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:(?:\\\\\\\\)?[\\"\\\\{]~"}], "cve": "CVE-2024-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2025", "description": "WC4BP <=3.4.20 PHP Object Injection via maybe_unserialize() in wc4bp_add_page AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wc4bp", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.4.20"}, "RULE-CVE-2024-2025-02": {"ajax_action": "wc4bp_delete_page", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:(?:\\\\\\\\)?[\\"\\\\{]~"}], "cve": "CVE-2024-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2025", "description": "WC4BP <=3.4.20 PHP Object Injection via maybe_unserialize() in wc4bp_delete_page AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wc4bp", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.4.20"}, "RULE-CVE-2024-2025-03": {"ajax_action": "wc4bp_edit_entry", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:(?:\\\\\\\\)?[\\"\\\\{]~"}], "cve": "CVE-2024-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2025", "description": "WC4BP <=3.4.20 PHP Object Injection via maybe_unserialize() in wc4bp_edit_entry AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wc4bp", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.4.20"}, "RULE-CVE-2024-2047-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"name": "ARGS:_elementor_data", "type": "contains", "value": "ekit_testimonial_style"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\"ekit_testimonial_style\\"\\\\s*:\\\\s*\\"[^\\\\\\"]{0,2000}(?:(?:(?:\\\\.{2}[\\\\\\\\/]){2,})|(?:(?:\\\\.(?:\\\\.(?:%(?:25)?2f|%(?:25)?5c))){2,})|(?:(?:\\\\\\\\u002e\\\\\\\\u002e(?:\\\\\\\\u002f|\\\\\\\\u005c)){2,})|/(?:etc/|proc/|var/|home/))[^\\\\\\"]{0,2000}\\"~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\"ekit_testimonial_style\\"\\\\s*:\\\\s*\\"(?!style[1-6]\\")[^\\\\\\"]+\\"~"}], "cve": "CVE-2024-2047", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elementskit-lite", "target": "plugin", "versions": "<3.0.7"}, "RULE-CVE-2024-2088-01": {"ajax_action": "nxs_getExpSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2088", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2088", "description": "NextScripts Social Networks Auto-Poster <=3.8.8 authenticated sensitive information exposure via nxs_getExpSettings", "mode": "block", "severity": 6.5, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["sensitive-data-exposure", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=3.8.8"}, "RULE-CVE-2024-2115-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "accept-request"}, {"name": "ARGS:user_id", "type": "exists"}], "cve": "CVE-2024-2115", "method": "GET", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2024-2115-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "deny-request"}, {"name": "ARGS:user_id", "type": "exists"}], "cve": "CVE-2024-2115", "method": "GET", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2024-2122-01": {"ajax_action": "foogallery_save_gallery_details", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2122", "description": "FooGallery <=2.4.15 contributor+ stored XSS via album gallery custom URLs in save_gallery_details", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=2.4.15"}, "RULE-CVE-2024-2122-02": {"ajax_action": "foogallery_get_gallery_details", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2122", "description": "FooGallery <=2.4.15 contributor+ stored XSS via album gallery custom URLs in get_gallery_details", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=2.4.15"}, "RULE-CVE-2024-2123-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/members~"}, {"name": "ARGS:first_name", "type": "regex", "value": "~(?:]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-2123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2123", "description": "Ultimate Member <=2.8.3 stored XSS in member directory via display_name", "method": "GET", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "stored", "shortcode"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2024-2123-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:user_login", "type": "regex", "value": "~(?:]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-2123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2123", "description": "Ultimate Member <=2.8.3 unauthenticated stored XSS via registration form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2024-2123-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:first_name", "type": "regex", "value": "~(?:]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-2123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2123", "description": "Ultimate Member <=2.8.3 authenticated stored XSS via profile update", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2024-2125-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/envialosimple/v1/gallery/add(?:/|\\\\?|&|$)~"}, {"name": "FILES:file", "type": "exists"}], "cve": "CVE-2024-2125", "method": "POST", "mode": "block", "severity": 8.8, "slug": "envialosimple-email-marketing-y-newsletters-gratis", "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2024-21751-01": {"ajax_action": "rabbitloader_ajax_purge", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-21751-02": {"ajax_action": "rabbitloader_mode_change", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-21751-03": {"ajax_action": "rabbitloader_ajax_cron", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-21751-04": {"ajax_action": "rabbitloader_ajax_survey_dismissed", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-2194-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:]|]|=3.14.0"}, "RULE-CVE-2024-2242-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpcf7"}, {"name": "ARGS:action", "type": "equals", "value": "edit"}, {"name": "ARGS:active-tab", "type": "regex", "value": "~(?:]|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2024-2242", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2242", "description": "Contact Form 7 <=5.9 reflected XSS via active-tab parameter on admin edit page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "contact-form-7", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=5.9"}, "RULE-CVE-2024-2302-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-content/uploads/edd(?:-logs)?/.*\\\\.(?:log|log\\\\.[0-9]+|log\\\\.bak|log\\\\.old)(?:/)?(?:\\\\?|$)~i"}], "cve": "CVE-2024-2302", "method": "GET", "mode": "block", "severity": 5.3, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.2.9"}, "RULE-CVE-2024-2302-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-content/uploads/edd(?:-logs)?(?:/)?(?:\\\\?.*)?$~i"}], "cve": "CVE-2024-2302", "method": "GET", "mode": "block", "severity": 5.3, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.2.9"}, "RULE-CVE-2024-2341-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:keys", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via keys parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:appointment_id", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via appointment_id parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:meta_key", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via meta_key parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:customer_id", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via customer_id parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:group_id", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via group_id parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_(?:booking|appointments?|upcoming_appointments?|admin_app)[^\\\\]]*customer_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\'\\"]\\\\s*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP|BENCHMARK|EXTRACTVALUE|CONCAT)\\\\b|--\\\\s|/\\\\*|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE))~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via malicious shortcode customer_id attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_(?:booking|appointments?|upcoming_appointments?|admin_app)[^\\\\]]*group_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\'\\"]\\\\s*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP|BENCHMARK|EXTRACTVALUE|CONCAT)\\\\b|--\\\\s|/\\\\*|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE))~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via malicious shortcode group_id attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_[^\\\\]]*customer_id\\\\s*=\\\\s*[\\"\'][^\\"\']*[^\\\\d\\\\s\\"\'\\\\]][^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via non-numeric customer_id shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_[^\\\\]]*group_id\\\\s*=\\\\s*[\\"\'][^\\"\']*[^\\\\d\\\\s\\"\'\\\\]][^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via non-numeric group_id shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2345-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/filebird/~"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2345", "description": "FileBird <=5.6.3 authenticated (author+) stored XSS via folder name parameter in REST API", "mode": "block", "severity": 6.4, "slug": "filebird", "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-2350-01": {"action": "elementor_save", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_save"}, {"name": "ARGS:data", "type": "contains", "value": "\\"widgetType\\":\\"clever-"}, {"name": "ARGS:data", "type": "regex", "value": "~(?i)(]*>|javascript:|onerror\\\\s*=)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2350", "description": "Clever Addons for Elementor (cafe-lite) <= 2.1.9 \\u2013 Contributor+ stored XSS via CAFE Icon, CAFE Team Member, and CAFE Slider Elementor widget settings; blocks script-style payloads in widget JSON for users without unfiltered_html.\\n", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cafe-lite", "tags": ["xss", "stored", "elementor", "widgets", "wordpress"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2024-23500-01": {"ajax_action": "kadence_import_process_image_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-23500", "description": "Kadence Blocks <=3.2.19 authenticated SSRF via kadence_import_process_image_data AJAX handler", "mode": "block", "severity": 7.7, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.2.19"}, "RULE-CVE-2024-23500-02": {"ajax_action": "kadence_import_process_pattern", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-23500", "description": "Kadence Blocks <=3.2.19 authenticated SSRF via kadence_import_process_pattern AJAX handler", "mode": "block", "severity": 7.7, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.2.19"}, "RULE-CVE-2024-2417-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "user_registration_form_save_action"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2417", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2417", "description": "User Registration <=3.1.5 missing authorization in form_save_action allows subscriber+ privilege escalation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "user-registration", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.1.5"}, "RULE-CVE-2024-2441-01": {"ajax_action": "vikbooking", "conditions": [{"name": "ARGS:task", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2024-2441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2441", "description": "VikBooking <=1.6.7 IDOR via wp_ajax_vikbooking allows authenticated low-privilege users to access admin settings", "method": "POST", "mode": "block", "severity": 8.1, "slug": "vikbooking", "tags": ["idor", "missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2024-2484-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:service_title_tag|services_text_align)[^}]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]+on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2484", "description": "Orbit Fox by ThemeIsle <=2.10.34 contributor+ stored XSS via Services widget service_title_tag/services_text_align in Elementor actions blob", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.34"}, "RULE-CVE-2024-2484-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~service_text[^}]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2484", "description": "Orbit Fox by ThemeIsle <=2.10.34 contributor+ stored XSS via Services widget service_text in Elementor actions blob", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.34"}, "RULE-CVE-2024-2484-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~title_tag[^}]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]+on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2484", "description": "Orbit Fox by ThemeIsle <=2.10.34 contributor+ stored XSS via Posts Grid widget title_tag in Elementor actions blob", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.34"}, "RULE-CVE-2024-24934-01": {"ajax_action": "elementor_library_direct_actions", "conditions": [{"name": "ARGS:library_action", "type": "regex", "value": "~^(delete_library_template|delete_kit|update_kit|import_kit)$~i"}, {"name": "ARGS:source", "type": "regex", "value": "~(^|/|\\\\\\\\|%2f|%5c)(\\\\.\\\\.|%2e%2e)(/|\\\\\\\\|%2f|%5c)~i"}], "cve": "CVE-2024-24934", "mode": "block", "severity": 8.1, "slug": "elementor", "target": "plugin", "versions": "<=3.19.0"}, "RULE-CVE-2024-24934-02": {"ajax_action": "elementor_library_direct_actions", "conditions": [{"name": "ARGS:library_action", "type": "regex", "value": "~^(import_kit|import_template|sync_library)$~i"}, {"name": "ARGS:source", "type": "regex", "value": "~phar://~i"}], "cve": "CVE-2024-24934", "mode": "block", "severity": 8.1, "slug": "elementor", "target": "plugin", "versions": "<=3.19.0"}, "RULE-CVE-2024-25600-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~bricks(?:/|%2f)v1(?:/|%2f)render_element~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-25600", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-25600", "description": "Unauthenticated remote code execution in Bricks Builder <= 1.9.6. The REST route bricks/v1/render_element (includes/api.php:17,25-32) has a permission callback that checks only wp_verify_nonce($data[\'nonce\'],\'bricks-nonce\') and never a capability (api.php:194-206), and that nonce is handed to anonymous visitors: frontend.php:364 emits it through wp_localize_script(\'bricks-scripts\',\'bricksData\',[... \'nonce\' => wp_create_nonce(\'bricks-nonce\') ...]) on public pages. The request-supplied query settings reach eval($php_query_raw) at includes/query.php:340-351. This rule gates the route on caller privilege rather than on the payload: both api.php:156 and :195 read the body with WP_REST_Request::get_json_params(), which WordPress populates only for a JSON content type, so $_POST stays empty and an ARGS-based payload rule would be inert and would report coverage while matching nothing. The only legitimate caller of this endpoint is the builder canvas (render_element appears solely in assets/js/iframe.min.js), which always runs as a user holding builder rights, and Bricks builder access implies post editing - so requiring edit_posts blocks the unauthenticated and subscriber population without touching a real builder session. The admin-ajax twin bricks_render_element is not the vector: ajax.php:104-110 already gates it on Capabilities::current_user_can_use_builder(). Note the same eval sink is also reachable through bricks/v1/load_query_page and bricks/v1/query_result, which anonymous visitors legitimately use for infinite scroll and filtering; a capability gate there would break the front end, so those remain uncovered by design.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "bricks", "tags": ["rce", "code-injection", "unauthenticated", "rest-api", "bricks"], "target": "theme", "versions": "<=1.9.6"}, "RULE-CVE-2024-25935-01": {"ajax_action": "rm_options_default_payment_method", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-25935", "method": "POST", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.2.5.9"}, "RULE-CVE-2024-2650-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"alignment\\"\\\\s*:\\\\s*\\"[^\\"]*[<>]~i"}], "cve": "CVE-2024-2650", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.11"}, "RULE-CVE-2024-2667-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/instawp-connect/v1/config(?:/|\\\\?|&|$)~"}, {"name": "ARGS:override_plugin_zip", "type": "exists"}], "cve": "CVE-2024-2667", "method": "POST", "mode": "block", "severity": 9.8, "slug": "instawp-connect", "target": "plugin", "versions": "<=0.1.0.22"}, "RULE-CVE-2024-2702-01": {"ajax_action": "olive_demo_import", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2702", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2702", "description": "Olive One Click Demo Import <=1.1.1 missing authorization on demo import allowing unauthenticated stored XSS via olive_demo_import AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "olive-one-click-demo-import", "tags": ["missing-authorization", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2024-2771-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluentform/v1/managers(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "fluentform_full_access"}], "cve": "CVE-2024-2771", "method": "POST", "mode": "block", "severity": 9.8, "slug": "fluentform", "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2024-2771-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluentform/v1/managers(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "fluentform_full_access"}], "cve": "CVE-2024-2771", "method": "DELETE", "mode": "block", "severity": 9.8, "slug": "fluentform", "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2024-2782-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluentform/v1/global-settings(?:[/?]|$)~"}, {"type": "missing_capability", "value": "fluentform_settings_manager"}], "cve": "CVE-2024-2782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2782", "description": "Fluent Forms <=5.1.16 missing authorization on global-settings REST API endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "fluentform", "tags": ["missing-authorization", "rest-api", "unauthorized"], "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2024-27956-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-content/plugins/wp-automatic/inc/csv\\\\.php~i"}, {"name": "ARGS:q", "type": "detectSQLi"}], "cve": "CVE-2024-27956", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27956", "description": "wp-automatic (Automatic) <=3.92.0 unauthenticated SQL injection via the q parameter of the direct-access inc/csv.php script (CVE-2024-27956, mass-exploited 2024). The script builds a SQL query from the attacker-controlled q parameter after a bypassable auth/integ check. Blocks requests to /wp-content/plugins/wp-automatic/inc/csv.php whose q parameter contains a SQL-injection payload; legitimate CSV-export calls carry a benign q and are unaffected.", "mode": "block", "severity": 9.8, "slug": "wp-automatic", "tags": ["sql-injection", "unauthenticated", "direct-script-access"], "target": "plugin", "versions": "<=3.92.0"}, "RULE-CVE-2024-27987-01": {"action": "init", "conditions": [{"name": "ARGS:form_id", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via form_id parameter in shortcode rendering", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:start-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via start-date parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:end-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via end-date parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:status", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via status parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:donor", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via donor parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:order", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via order parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:start-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via start-date parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-08": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:end-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via end-date parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-09": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:status", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via status parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-10": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:donor", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via donor parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-11": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "give_forms"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via s (search) parameter in admin forms list", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-12": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "give_forms"}, {"name": "ARGS:start-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via start-date parameter in admin forms list", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-13": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "give_forms"}, {"name": "ARGS:end-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via end-date parameter in admin forms list", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-28000-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/users(?:/|\\\\?|$|$)~"}, {"name": "REQUEST_COOKIES:litespeed_hash", "type": "exists"}], "cve": "CVE-2024-28000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-28000", "description": "LiteSpeed Cache >=1.9 <=6.3.0.1 unauthenticated privilege escalation via cookie-based role simulation on WP REST /wp/v2/users endpoint (litespeed_hash brute-force)", "mode": "block", "severity": 9.8, "slug": "litespeed-cache", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": ">=1.9 <=6.3.0.1"}, "RULE-CVE-2024-2831-01": {"action": "admin_init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[calendar[^\\\\]]*categories\\\\s*=\\\\s*[\\\\\\"\'][^\\\\]]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CONCAT|GROUP_CONCAT|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|BENCHMARK|SLEEP|OR\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|AND\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|--|;|/\\\\*)[^\\\\]]*[\\\\\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2831", "method": "POST", "mode": "block", "severity": 8.8, "slug": "calendar", "target": "plugin", "versions": "<=1.3.14"}, "RULE-CVE-2024-2831-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[calendar[^\\\\]]*categories\\\\s*=\\\\s*[\\\\\\"\'][^\\\\]]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CONCAT|GROUP_CONCAT|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|BENCHMARK|SLEEP|OR\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|AND\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|--|;|/\\\\*)[^\\\\]]*[\\\\\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2831", "method": "POST", "mode": "block", "severity": 8.8, "slug": "calendar", "target": "plugin", "versions": "<=1.3.14"}, "RULE-CVE-2024-2876-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:method", "type": "regex", "value": "~^get_matching_recipients_count$~"}, {"name": "ARGS", "type": "regex", "value": "~\'\\\\s*(\\\\)|;|union\\\\b|select\\\\b|insert\\\\b|update\\\\b|delete\\\\b|drop\\\\b|--|#|/\\\\*)|\'\\\\s+(?:or|and)\\\\b~i"}], "cve": "CVE-2024-2876", "description": "SQL injection in Email Subscribers & Newsletters (Icegram Express) <=5.7.14: non-numeric elements of a _click_link condition value are interpolated unescaped into \\"link IN (\'\')\\" in IG_ES_Subscribers_Query::run() (SINK class-ig-es-subscriber-query.php:304; fixed 5.7.15 esc_sql). ENTRYPOINT wp_ajax_nopriv_icegram-express -> ES_Router::handle_ajax_request -> ES_Campaign_Controller::get_matching_recipients_count, payload data[list_conditions][..][value][..].", "method": "POST", "mode": "block", "severity": 9.8, "slug": "email-subscribers", "target": "plugin", "versions": "<=5.7.14"}, "RULE-CVE-2024-29090-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/settings/update(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-29090", "method": "POST", "mode": "block", "severity": 6.8, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-29100-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai(-ui)?/v1/~i"}, {"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml|phar|pht|shtml|cgi|asp|aspx|jsp|jspx)(?:\\\\?|#|$)~i"}], "cve": "CVE-2024-29100", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-29100-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai(-ui)?/v1/~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml|phar|pht|shtml|cgi|asp|aspx|jsp|jspx)(?:\\\\?|#|$)~i"}], "cve": "CVE-2024-29100", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-29113-01": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29113-02": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29113-03": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29113-04": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_sort", "type": "regex", "value": "~^(?!(?:latest|oldest|0toz|zto0)$).+~"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29117-01": {"ajax_action": "accua_form_submit", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~<(?:script|iframe|img|svg)[^>]*>~i"}], "cve": "CVE-2024-29117", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contact-forms", "target": "plugin", "versions": "<=1.7.0"}, "RULE-CVE-2024-2933-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:/|\\\\?|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:coblocks/social-profiles[\\\\s\\\\S]{0,4000}?(?:javascript|data|vbscript)\\\\s*(?::|&#(?:x3a|58))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2933", "description": "CoBlocks <=3.1.9 contributor+ stored XSS via coblocks/social-profiles block URL attribute (REST post save)", "mode": "block", "severity": 6.4, "slug": "coblocks", "target": "plugin", "versions": "<=3.1.9"}, "RULE-CVE-2024-2933-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:coblocks/social-profiles[\\\\s\\\\S]{0,4000}?(?:javascript|data|vbscript)\\\\s*(?::|&#(?:x3a|58))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2933", "description": "CoBlocks <=3.1.9 contributor+ stored XSS via coblocks/social-profiles block URL attribute (classic editor post.php save)", "mode": "block", "severity": 6.4, "slug": "coblocks", "target": "plugin", "versions": "<=3.1.9"}, "RULE-CVE-2024-29808-01": {"ajax_action": "editimage_bwg", "conditions": [{"name": "ARGS:image_id", "type": "regex", "value": "~(?:<[a-zA-Z/!]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|[\'\\\\\\"]\\\\s*;|%3[Cc]|%22|%27)~"}], "cve": "CVE-2024-29808", "description": "Photo Gallery by 10Web <=1.8.40 authenticated reflected XSS via image_id parameter in editimage_bwg AJAX action", "mode": "block", "severity": 5.4, "slug": "photo-gallery", "target": "plugin", "versions": "<=1.8.40"}, "RULE-CVE-2024-29931-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:map_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via map_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-29931-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:poly_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via poly_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-29931-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:circle_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via circle_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-29931-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:rectangle_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via rectangle_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-3018-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php|/wp-json/elementor/)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~\\"error_resetpassword\\"\\\\s*:\\\\s*\\"(?:O|C):[0-9]+:~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2024-3018", "method": "POST", "mode": "block", "severity": 8.8, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.13"}, "RULE-CVE-2024-3020-01": {"ajax_action": "wpcp_import_shortcodes", "conditions": [{"name": "ARGS:shortcode", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3020", "description": "WP Carousel <=2.6.3 authenticated PHP object injection via wpcp_import_shortcodes AJAX handler", "mode": "block", "severity": 7.2, "slug": "wp-carousel-free", "target": "plugin", "versions": "<=2.6.3"}, "RULE-CVE-2024-30226-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/betterdocs/faq/(?:create_post|update_post|delete_post|create_category|update_category|delete_category|category_order|update_order_by_category|category_search|category_status|sample_data|uncategorised|posts/)~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2024-30226", "description": "BetterDocs <=3.3.3 unauthenticated PHP object injection via FAQBuilder REST API routes", "mode": "block", "severity": 9.0, "slug": "betterdocs", "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-30229-01": {"ajax_action": "give_donation_import", "conditions": [{"name": "ARGS:mapto", "type": "exists"}, {"name": "ARGS:mapto", "type": "regex", "value": "~(?i)O:\\\\+?\\\\d+:\\"[^\\"]*\\":\\\\+?\\\\d+:\\\\{~"}], "cve": "CVE-2024-30229", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-30229", "description": "GiveWP <= 3.4.2 \\u2013 PHP Object Injection via mapto in give_donation_import AJAX action (CWE-502, CVSS 7.2)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "give", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2024-30231-01": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2024-30231", "description": "Product Import Export for WooCommerce <=2.4.1 authenticated arbitrary file upload via iew_import_ajax_basic AJAX handler \\u2014 missing authorization", "mode": "block", "severity": 9.1, "slug": "product-import-export-for-woo", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2024-30464-01": {"ajax_action": "zoom_ajax_set_pointer_transient", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-30464", "description": "Social Icons Widget & Block by WPZOOM <=4.2.15 missing authorization on zoom_ajax_set_pointer_transient AJAX handler", "mode": "block", "severity": 8.8, "slug": "social-icons-widget-by-wpzoom", "target": "plugin", "versions": "<=4.2.15"}, "RULE-CVE-2024-30485-01": {"ajax_action": "xl_addon_installation", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2024-30485", "description": "Finale Lite <=2.18.0 subscriber+ arbitrary plugin installation/activation via xl_addon_installation AJAX handler", "mode": "block", "severity": 8.8, "slug": "finale-woocommerce-sales-countdown-timer-discount", "target": "plugin", "versions": "<=2.18.0"}, "RULE-CVE-2024-30501-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json)?/download-monitor/v1/~"}, {"name": "ARGS:limit", "type": "detectSQLi"}], "cve": "CVE-2024-30501", "method": "GET", "mode": "block", "severity": 7.2, "slug": "download-monitor", "target": "plugin", "versions": "<=4.9.4"}, "RULE-CVE-2024-30501-02": {"ajax_action": "dlm_top_downloads_reports", "conditions": [{"name": "ARGS:limit", "type": "detectSQLi"}], "cve": "CVE-2024-30501", "method": "POST", "mode": "block", "severity": 7.2, "slug": "download-monitor", "target": "plugin", "versions": "<=4.9.4"}, "RULE-CVE-2024-30516-01": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:scheduleCost", "type": "regex", "value": "~^\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|[+-]?(?:0+(?:\\\\.0*)?|0*\\\\.0+)(?:[eE][+-]?0+)?)\\\\s*$~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30516-02": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:cost", "type": "regex", "value": "~^\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|[+-]?(?:0+(?:\\\\.0*)?|0*\\\\.0+)(?:[eE][+-]?0+)?)\\\\s*$~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30516-03": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:guests", "type": "regex", "value": "~\\"cost\\"\\\\s*:\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|0(?:\\\\.0+)?)(?!\\\\.)(?=\\\\s*[,\\\\}\\\\]])~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30516-04": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:services", "type": "regex", "value": "~\\"cost\\"\\\\s*:\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|0(?:\\\\.0+)?)(?!\\\\.)(?=\\\\s*[,\\\\}\\\\]])~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30549-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "accua-forms-edit"}, {"name": "ARGS:edit-fid", "type": "detectXSS"}], "cve": "CVE-2024-30549", "method": "GET", "mode": "block", "severity": 4.8, "slug": "contact-forms", "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2024-30549-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "accua-forms-submissions"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2024-30549", "method": "GET", "mode": "block", "severity": 4.8, "slug": "contact-forms", "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2024-3055-01": {"ajax_action": "unitecreator_elementor_export_template", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[^0-9,\\\\s]~"}], "cve": "CVE-2024-3055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3055", "description": "Unlimited Elements For Elementor <=1.5.102 authenticated (Contributor+) time-based SQL injection via id parameter in export template AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "unlimited-elements-for-elementor", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.5.102"}, "RULE-CVE-2024-3055-02": {"ajax_action": "unitecreator_elementor_import_template", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[^0-9,\\\\s]~"}], "cve": "CVE-2024-3055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3055", "description": "Unlimited Elements For Elementor <=1.5.102 authenticated (Contributor+) time-based SQL injection via id parameter in import template AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "unlimited-elements-for-elementor", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.5.102"}, "RULE-CVE-2024-3105-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[[]insert_php([^a-zA-Z0-9_][^]]*|)[]]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3105", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3105", "description": "Starter Templates by suspended developer (Insert PHP) <=2.5.0 authenticated (Contributor+) RCE via insert_php shortcode in post content", "method": "POST", "mode": "block", "severity": 9.9, "slug": "insert-php", "tags": ["remote-code-execution", "shortcode", "missing-authorization"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2024-3107-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/spectra/v1/editor(?:/|\\\\?|$)~"}, {"name": "ARGS:block_name", "type": "regex", "value": "~(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\|%2e%2e%2f|%2e%2e/|\\\\.\\\\.%2f|\\\\.\\\\.%5c|%2e%2e%5c)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3107", "method": "GET", "mode": "block", "severity": 4.3, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.12.6"}, "RULE-CVE-2024-31113-01": {"ajax_action": "edd_recapture_remote_install", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-31113", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.2.11"}, "RULE-CVE-2024-3136-01": {"ajax_action": "stm_lms_load_content", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.\\\\.%2[fF]|\\\\.\\\\.%5[cC])~"}], "cve": "CVE-2024-3136", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3136", "description": "MasterStudy LMS <=3.3.3 unauthenticated Local File Inclusion via template parameter in stm_lms_load_content AJAX handler", "mode": "block", "severity": 9.8, "slug": "masterstudy-lms-learning-management-system", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-3136-02": {"ajax_action": "stm_lms_load_modal", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.\\\\.%2[fF]|\\\\.\\\\.%5[cC])~"}], "cve": "CVE-2024-3136", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3136", "description": "MasterStudy LMS <=3.3.3 unauthenticated Local File Inclusion via template parameter in stm_lms_load_modal AJAX handler", "mode": "block", "severity": 9.8, "slug": "masterstudy-lms-learning-management-system", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-3161-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:jkit[-_]countdown|sg_countdown|sg_expire).*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3161", "description": "Jeg Elementor Kit <=2.6.4 contributor+ stored XSS via countdown widget attributes in Elementor editor save (elementor_ajax)", "mode": "block", "severity": 6.4, "slug": "jeg-elementor-kit", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-3161-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:jkit[-_]countdown|sg_countdown|sg_expire).*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3161", "description": "Jeg Elementor Kit <=2.6.4 contributor+ stored XSS via countdown widget attributes in Elementor REST API document save", "mode": "block", "severity": 6.4, "slug": "jeg-elementor-kit", "tags": ["xss", "stored", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-3188-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=)~i"}], "cve": "CVE-2024-3188", "description": "Shortcodes Ultimate <7.1.0 reflected XSS via su_generator_preview AJAX handler (subscriber+)", "mode": "block", "severity": 6.3, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<7.1.0"}, "RULE-CVE-2024-3188-02": {"ajax_action": "su_generator_settings", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=)~i"}], "cve": "CVE-2024-3188", "description": "Shortcodes Ultimate <7.1.0 reflected XSS via su_generator_settings AJAX handler (subscriber+)", "mode": "block", "severity": 6.3, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<7.1.0"}, "RULE-CVE-2024-3210-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~reg-single-checkbox[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]*on\\\\w+\\\\s*=|]+on\\\\w+\\\\s*=)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3210", "description": "ProfilePress <=4.15.5 contributor+ stored XSS via reg-single-checkbox shortcode label attribute", "mode": "block", "severity": 6.4, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.15.5"}, "RULE-CVE-2024-3211-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ec_addtocart\\\\b[^\\\\]]*productid\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CONCAT|SLEEP|BENCHMARK|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|OR\\\\s+\\\\d|AND\\\\s+\\\\d|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-3211", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3211", "description": "Shopping Cart & eCommerce Store <=5.6.3 SQL Injection via ec_addtocart shortcode productid attribute in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-easycart", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-3211-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ec_addtocart\\\\b[^\\\\]]*productid\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CONCAT|SLEEP|BENCHMARK|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|OR\\\\s+\\\\d|AND\\\\s+\\\\d|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-3211", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3211", "description": "Shopping Cart & eCommerce Store <=5.6.3 SQL Injection via ec_addtocart shortcode productid attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-easycart", "tags": ["sql-injection", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-3217-01": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:attribute_id", "type": "regex", "value": "~[^0-9a-zA-Z_\\\\-]~"}], "cve": "CVE-2024-3217", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3217", "description": "WP Directory Kit <=1.3.0 SQL Injection via attribute_id parameter in wdk_public_action AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpdirectorykit", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2024-3217-02": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:attribute_value", "type": "regex", "value": "~[^0-9a-zA-Z_\\\\-]~"}], "cve": "CVE-2024-3217", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3217", "description": "WP Directory Kit <=1.3.0 SQL Injection via attribute_value parameter in wdk_public_action AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpdirectorykit", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2024-32505-01": {"ajax_action": "ekit_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-32505", "description": "ElementsKit Lite <=3.0.6 Contributor+ stored XSS via ekit_admin_action settings injection", "mode": "block", "severity": 6.5, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.0.6"}, "RULE-CVE-2024-32567-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "detectXSS"}], "cve": "CVE-2024-32567", "method": "GET", "mode": "block", "severity": 6.1, "slug": "directorypress", "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2024-32698-01": {"ajax_action": "ha_twitter_feed_action", "conditions": [{"name": "ARGS:query_settings", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*i(?:mg|frame)[\\\\s/][^>]*(?:src|onerror)\\\\s*=)~i"}], "cve": "CVE-2024-32698", "description": "Happy Addons for Elementor <=3.10.4 stored XSS via query_settings in ha_twitter_feed_action AJAX handler", "mode": "block", "severity": 6.5, "slug": "happy-elementor-addons", "target": "plugin", "versions": "<=3.10.4"}, "RULE-CVE-2024-32698-02": {"ajax_action": "ha_post_tab_action", "conditions": [{"name": "ARGS:post_tab_query", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*i(?:mg|frame)[\\\\s/][^>]*(?:src|onerror)\\\\s*=)~i"}], "cve": "CVE-2024-32698", "description": "Happy Addons for Elementor <=3.10.4 stored XSS via post_tab_query in ha_post_tab_action AJAX handler", "mode": "block", "severity": 6.5, "slug": "happy-elementor-addons", "target": "plugin", "versions": "<=3.10.4"}, "RULE-CVE-2024-3293-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[rtmedia_gallery\\\\b[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|SELECT|UNION|INSERT|UPDATE|DELETE|DROP|ALTER|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|\\\\(\\\\s*SELECT)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3293", "method": "POST", "mode": "block", "severity": 8.8, "slug": "buddypress-media", "target": "plugin", "versions": "<=4.6.18"}, "RULE-CVE-2024-3293-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[rtmedia_gallery\\\\b[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|SELECT|UNION|INSERT|UPDATE|DELETE|DROP|ALTER|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|\\\\(\\\\s*SELECT)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3293", "method": "POST", "mode": "block", "severity": 8.8, "slug": "buddypress-media", "target": "plugin", "versions": "<=4.6.18"}, "RULE-CVE-2024-3342-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mp-timetable[^\\\\]]*\\\\bevents\\\\s*=\\\\s*(?:[\'\\"][^\'\\"]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\'\\"]*[\'\\"]|[^\\\\s\\\\]]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\\\\s\\\\]]*)~i"}], "cve": "CVE-2024-3342", "mode": "block", "severity": 9.9, "slug": "mp-timetable", "target": "plugin", "versions": "<=2.4.11"}, "RULE-CVE-2024-3342-02": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mp-timetable[^\\\\]]*\\\\bevents\\\\s*=\\\\s*(?:[\'\\"][^\'\\"]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\'\\"]*[\'\\"]|[^\\\\s\\\\]]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\\\\s\\\\]]*)~i"}], "cve": "CVE-2024-3342", "mode": "block", "severity": 9.9, "slug": "mp-timetable", "target": "plugin", "versions": "<=2.4.11"}, "RULE-CVE-2024-3343-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~themeisle-blocks/[a-z-]+\\\\s*\\\\{[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]*on\\\\w+\\\\s*=|<\\\\s*img[^>]*on\\\\w+\\\\s*=)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3343", "description": "Otter Blocks <=2.6.8 contributor+ stored XSS via block attributes in post content", "mode": "block", "severity": 6.4, "slug": "otter-blocks", "target": "plugin", "versions": "<=2.6.8"}, "RULE-CVE-2024-3344-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:async-upload|media-new)\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg(?:z)?$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:]|on(?:load|error|click|mouseover|focus|begin|end|activate)\\\\s*=|javascript\\\\s*:|]|on(?:load|error|click|mouseover|focus|begin|end|activate)\\\\s*=|javascript\\\\s*:|]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-33947", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.2.0"}, "RULE-CVE-2024-33947-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-33947", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.2.0"}, "RULE-CVE-2024-33947-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-33947", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.2.0"}, "RULE-CVE-2024-34440-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/upload(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-34440-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/delete(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-34440-03-DELETE": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/delete(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "method": "DELETE", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-34440-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/list(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-3492-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:event|location|event_category|events_list_grouped|events_list|events_calendar|events_map|events_link|events_gcal|event_form|event_search_form|categories_list)\\\\b[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|].*?on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-3548", "description": "Shortcodes Ultimate <7.1.2 authenticated reflected XSS via shortcode parameter in su_generator_preview AJAX handler", "mode": "block", "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<7.1.2"}, "RULE-CVE-2024-3549-01": {"ajax_action": "b2s_sort_data", "conditions": [{"name": "ARGS:b2sSortPostType", "type": "detectSQLi"}], "cve": "CVE-2024-3549", "method": "POST", "mode": "block", "severity": 9.9, "slug": "blog2social", "target": "plugin", "versions": "<=7.4.1"}, "RULE-CVE-2024-3550-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_(?:lightbox|dailymotion|service|anchor|heading|button|tab|spoiler|accordion|audio|video|animate|tooltip|permalink|members|guests|feed|menu|subpages|siblings|carousel|custom_gallery|slider|gmap|posts)\\\\s[^\\\\]]*(?:on(?:error|load|mouse(?:over|out|enter|move|down|up)|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|select)\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s+on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3550", "description": "Shortcodes Ultimate <=7.1.2 stored XSS via shortcode attributes in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.1.2"}, "RULE-CVE-2024-3550-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_(?:lightbox|dailymotion|service|anchor|heading|button|tab|spoiler|accordion|audio|video|animate|tooltip|permalink|members|guests|feed|menu|subpages|siblings|carousel|custom_gallery|slider|gmap|posts)\\\\s[^\\\\]]*(?:on(?:error|load|mouse(?:over|out|enter|move|down|up)|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|select)\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s+on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3550", "description": "Shortcodes Ultimate <=7.1.2 stored XSS via shortcode attributes in post content (classic editor)", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.1.2"}, "RULE-CVE-2024-3550-03": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:]|on(?:error|load|mouse(?:over|out|enter)|focus|blur|click|dblclick)\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s+on[a-z]+=)~i"}], "cve": "CVE-2024-3550", "description": "Shortcodes Ultimate <=7.1.2 reflected XSS via su_generator_preview AJAX shortcode parameter", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.1.2"}, "RULE-CVE-2024-3552-01": {"ajax_action": "w2dc_get_map_marker_info", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SELECT\\\\s+.+\\\\s+FROM|AND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|OR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+)~"}], "cve": "CVE-2024-3552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3552", "description": "Web Directory Free <=1.6.9 unauthenticated SQL injection via locations_ids parameter in w2dc_get_map_marker_info AJAX handler", "mode": "block", "severity": 9.8, "slug": "web-directory-free", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2024-3557-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpgmza\\\\b[^\\\\]]*(?/])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3557", "description": "WP Go Maps <=9.0.36 contributor+ stored XSS via wpgmza shortcode attributes in post content (classic editor)", "mode": "block", "severity": 6.4, "slug": "wp-google-maps", "tags": ["xss", "stored", "authenticated", "shortcode"], "target": "plugin", "versions": "<=9.0.36"}, "RULE-CVE-2024-3557-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpgmza\\\\b[^\\\\]]*(?/])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3557", "description": "WP Go Maps <=9.0.36 contributor+ stored XSS via wpgmza shortcode attributes in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "wp-google-maps", "tags": ["xss", "stored", "authenticated", "shortcode", "rest-api"], "target": "plugin", "versions": "<=9.0.36"}, "RULE-CVE-2024-3560-01": {"action": "init", "conditions": [{"name": "ARGS:sort_by", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed)\\\\b|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-3560", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.4"}, "RULE-CVE-2024-3560-02": {"action": "init", "conditions": [{"name": "ARGS:c_level", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed)\\\\b|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-3560", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.4"}, "RULE-CVE-2024-3560-03": {"action": "init", "conditions": [{"name": "ARGS:c_authors", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed)\\\\b|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-3560", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.4"}, "RULE-CVE-2024-35683-01": {"ajax_action": "send-card-check", "conditions": [{"name": "ARGS:donation_id", "type": "exists"}], "cve": "CVE-2024-35683", "method": "POST", "mode": "block", "severity": 5.3, "slug": "leyka", "target": "plugin", "versions": "<=3.31.1"}, "RULE-CVE-2024-35690-01": {"ajax_action": "widgetopts_get_users", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-35690", "description": "Block unauthorized access to widgetopts_get_users AJAX handler (Subscriber+ User Meta Data Exposure)", "mode": "block", "severity": 6.5, "slug": "widget-options", "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2024-35690-02": {"ajax_action": "widgetopts_get_settings_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-35690", "description": "Block unauthorized access to widgetopts_get_settings_ajax AJAX handler (Subscriber+ Settings Data Exposure)", "mode": "block", "severity": 6.5, "slug": "widget-options", "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2024-35690-03": {"ajax_action": "widgetopts_get_legacy_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-35690", "description": "Block unauthorized access to widgetopts_get_legacy_data AJAX handler (Subscriber+ Legacy Data Exposure)", "mode": "block", "severity": 6.5, "slug": "widget-options", "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2024-3592-01": {"ajax_action": "qsm_bulk_delete_question_from_database", "conditions": [{"name": "ARGS:question_id", "type": "regex", "value": "~[^0-9,]~"}, {"type": "missing_capability", "value": "delete_published_posts"}], "cve": "CVE-2024-3592", "method": "POST", "mode": "block", "severity": 6.5, "slug": "quiz-master-next", "target": "plugin", "versions": "<=9.0.1"}, "RULE-CVE-2024-3592-02": {"ajax_action": "qsm_delete_question_from_database", "conditions": [{"name": "ARGS:question_id", "type": "regex", "value": "~[^0-9,]~"}, {"type": "missing_capability", "value": "delete_published_posts"}], "cve": "CVE-2024-3592", "method": "POST", "mode": "block", "severity": 6.5, "slug": "quiz-master-next", "target": "plugin", "versions": "<=9.0.1"}, "RULE-CVE-2024-3605-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wphb/v1/rooms/search-rooms(/|\\\\?|&|$)~"}, {"name": "ARGS:room_type", "type": "detectSQLi"}], "cve": "CVE-2024-3605", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wp-hotel-booking", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-37099-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-form-title", "type": "exists"}, {"name": "ARGS:give-form-title", "type": "regex", "value": "~[OaCd]:[0-9]+:~i"}], "cve": "CVE-2024-37099", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2024-3715-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "contact-form-listings"}, {"name": "ARGS:start_date", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+on[a-zA-Z]+\\\\s*=|]|]|])~i"}], "cve": "CVE-2024-3715", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3715", "description": "Database for Contact Form 7 <=1.3.8 reflected XSS via start_date parameter on admin leads page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "contact-form-entries", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2024-3715-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "contact-form-listings"}, {"name": "ARGS:end_date", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+on[a-zA-Z]+\\\\s*=|]|]|])~i"}], "cve": "CVE-2024-3715", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3715", "description": "Database for Contact Form 7 <=1.3.8 reflected XSS via end_date parameter on admin leads page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "contact-form-entries", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2024-3725-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~themeisle-blocks/posts-grid[^}]*\\"titleTag\\"\\\\s*:\\\\s*\\"(?!h[1-6]\\")[^\\"]*(?:<|on[a-z]+=|javascript:|%3[Cc])~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3725", "description": "Otter Blocks <=2.6.9 stored XSS via Post Grid widget titleTag block attribute", "mode": "block", "severity": 6.4, "slug": "otter-blocks", "target": "plugin", "versions": "<=2.6.9"}, "RULE-CVE-2024-3728-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php|/wp-json/elementor/)~"}, {"name": "ARGS:actions", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3728", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.15"}, "RULE-CVE-2024-3728-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php|/wp-json/elementor/)~"}, {"name": "ARGS:elements", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3728", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.15"}, "RULE-CVE-2024-3729-03": {"ajax_action": "frontend_admin/form_submit", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author)$~i"}], "cve": "CVE-2024-3729", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2024-3729-04": {"ajax_action": "frontend_admin/validate_form_submit", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author)$~i"}], "cve": "CVE-2024-3729", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2024-3733-01": {"ajax_action": "load_more", "conditions": [{"name": "ARGS:args", "type": "regex", "value": "~(?:^|&|%26)post_status(?:=|%3[Dd])(?:private|draft|pending|future|trash|any)(?:&|%26|$)~i"}], "cve": "CVE-2024-3733", "description": "Essential Addons for Elementor <=5.9.15 unauthenticated sensitive information exposure via load_more post_status manipulation", "mode": "block", "severity": 5.3, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.15"}, "RULE-CVE-2024-3733-02": {"ajax_action": "woo_product_pagination_product", "conditions": [{"name": "ARGS:args", "type": "regex", "value": "~(?:^|&|%26)post_status(?:=|%3[Dd])(?:private|draft|pending|future|trash|any)(?:&|%26|$)~i"}], "cve": "CVE-2024-3733", "description": "Essential Addons for Elementor <=5.9.15 unauthenticated sensitive information exposure via woo_product_pagination_product post_status manipulation", "mode": "block", "severity": 5.3, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.15"}, "RULE-CVE-2024-3733-03": {"ajax_action": "eael_product_gallery", "conditions": [{"name": "ARGS:args", "type": "regex", "value": "~(?:^|&|%26)post_status(?:=|%3[Dd])(?:private|draft|pending|future|trash|any)(?:&|%26|$)~i"}], "cve": "CVE-2024-3733", "description": "Essential Addons for Elementor <=5.9.15 unauthenticated sensitive information exposure via eael_product_gallery post_status manipulation", "mode": "block", "severity": 5.3, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.15"}, "RULE-CVE-2024-37489-01": {"ajax_action": "owp_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_name", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]|])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_name in owp_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37489-02": {"ajax_action": "owp_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_type", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]|])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_type in owp_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37489-03": {"ajax_action": "owp_wizard_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_name", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]|])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_name in owp_wizard_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37489-04": {"ajax_action": "owp_wizard_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_type", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]|])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_type in owp_wizard_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37517-01": {"ajax_action": "ast-block-templates-regenerate", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-37517", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-37517-02": {"ajax_action": "ast-block-templates-ai-content", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-37517", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-37517-03": {"ajax_action": "ast-block-templates-reset-business-details", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-37517", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-3820-01": {"ajax_action": "wdt_delete_table_row", "conditions": [{"name": "ARGS:id_key", "type": "detectSQLi"}], "cve": "CVE-2024-3820", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.1"}, "RULE-CVE-2024-3821-01": {"ajax_action": "wpdatatables_save_table_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_save_table_config AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-02": {"ajax_action": "wpdatatables_save_plugin_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_save_plugin_settings AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-03": {"ajax_action": "wpdatatables_duplicate_table", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_duplicate_table AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-04": {"ajax_action": "wpdatatables_create_simple_table", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_create_simple_table AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-05": {"ajax_action": "wpdatatables_save_simple_table_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_save_simple_table_data AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-06": {"ajax_action": "wpdatatable_save_chart_get_shortcode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_save_chart_get_shortcode AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-07": {"ajax_action": "wpdatatables_duplicate_chart", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_duplicate_chart AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-08": {"ajax_action": "wpdatatables_get_handsontable_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_get_handsontable_data AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-09": {"ajax_action": "wpdatatables_get_columns_data_by_table_id", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_get_columns_data_by_table_id AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-10": {"ajax_action": "wpdatatables_delete_log_errors_cache", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_delete_log_errors_cache AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-11": {"ajax_action": "wpdatatable_list_all_tables", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_list_all_tables AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-12": {"ajax_action": "wpdatatable_show_chart_from_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_show_chart_from_data AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-13": {"ajax_action": "wpdatatable_list_all_charts", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_list_all_charts AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-14": {"ajax_action": "wpdatatables_get_nested_json_roots", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_get_nested_json_roots AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3849-01": {"action": "init", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2024-3849", "description": "Click to Chat <=3.35 LFI via path parameter (covers ht_ctc_chat/ht_ctc_group/ht_ctc_share shortcodes)", "mode": "block", "slug": "click-to-chat-for-whatsapp", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2024-3849-02": {"action": "init", "conditions": [{"name": "ARGS:path_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2024-3849", "description": "Click to Chat <=3.35 LFI via path_file parameter (covers chat/group/share/woo renderers)", "mode": "block", "slug": "click-to-chat-for-whatsapp", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2024-3849-03": {"ajax_action": "ht_ctc_admin_dismiss_notices", "conditions": [{"name": "missing_capability", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3849", "description": "Click to Chat <=3.35 missing authorization on ht_ctc_admin_dismiss_notices AJAX handler", "mode": "block", "slug": "click-to-chat-for-whatsapp", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2024-38755-01": {"ajax_action": "directorypress_fields_edit_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_edit_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-02": {"ajax_action": "directorypress_fields_edit_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_edit_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-03": {"ajax_action": "directorypress_fields_config_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_config_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-04": {"ajax_action": "directorypress_fields_options_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_options_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-05": {"ajax_action": "directorypress_fields_search_settings_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_search_settings_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-06": {"ajax_action": "directorypress_fields_search_settings_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_search_settings_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-07": {"ajax_action": "directorypress_fields_group_edit_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_group_edit_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-08": {"ajax_action": "directorypress_fields_group_edit_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_group_edit_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-09": {"ajax_action": "directorypress_fields_delete_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_delete_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-10": {"ajax_action": "directorypress_fields_group_delete_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_group_delete_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-11": {"ajax_action": "directorypress_terms_configuration_html", "conditions": [{"name": "ARGS:term_id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via term_id parameter in directorypress_terms_configuration_html AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38791-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/simpleVisionQuery(/|\\\\?|$)~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:file|gopher|dict|ftp|ldap|tftp|ssh2)://|^https?://(?:127\\\\.(?:0\\\\.){2}1|0\\\\.0\\\\.0\\\\.0|localhost|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|\\\\[::1\\\\]|0177\\\\.0\\\\.0\\\\.1|2130706433|0x7f000001|metadata\\\\.google\\\\.internal)~i"}], "cve": "CVE-2024-38791", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-38791-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/simpleVisionQuery(/|\\\\?|$)~i"}, {"name": "ARGS:path", "type": "exists"}], "cve": "CVE-2024-38791", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-38793-01": {"ajax_action": "brm_edit_group", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_edit_group AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-02": {"ajax_action": "brm_delete_group", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_delete_group AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-03": {"ajax_action": "brm_edit_item", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_edit_item AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-04": {"ajax_action": "brm_delete_item", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_delete_item AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-05": {"ajax_action": "brm_save_group", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 missing authorization on brm_save_group allows subscriber+ SQL injection", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-06": {"ajax_action": "brm_save_item", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 missing authorization on brm_save_item allows subscriber+ SQL injection", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-07": {"ajax_action": "brm_order_nesting_groups_items", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 missing authorization on brm_order_nesting_groups_items allows subscriber+ SQL injection", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-3894-01": {"ajax_action": "robo_gallery_get_images_from_ids", "conditions": [{"name": "ARGS:idstring", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2024-3894", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3894", "description": "Robo Gallery <=3.2.19 stored XSS via idstring parameter in robo_gallery_get_images_from_ids AJAX handler", "mode": "block", "severity": 6.4, "slug": "robo-gallery", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=3.2.19"}, "RULE-CVE-2024-3954-01": {"ajax_action": "ditty_init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\\\\\"[^\\\\\\"]+\\\\\\":[0-9]+:~"}], "cve": "CVE-2024-3954", "description": "Ditty News Ticker <=3.1.38 authenticated PHP object injection via ditty_init AJAX handler", "mode": "block", "severity": 8.8, "slug": "ditty-news-ticker", "target": "plugin", "versions": "<=3.1.38"}, "RULE-CVE-2024-3962-01": {"ajax_action": "ppom_upload_file", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ppom_upload_file"}, {"name": "FILES:_file", "type": "exists"}, {"name": "FILES:_file:name", "type": "regex", "value": "/(?i)\\\\.(php\\\\d*|phtml|phar|php[-_]?s|cgi|pl|py|rb|sh|exe|jsp|asp|aspx|cfm|shtml)$|^[^.]+$/i"}], "cve": "CVE-2024-3962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3962", "description": "Product Addons & Fields for WooCommerce <=32.0.18 unauthenticated arbitrary file upload via ppom_upload_file", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woocommerce-product-addon", "tags": ["arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=32.0.18"}, "RULE-CVE-2024-39635-01": {"ajax_action": "youzify_admin_data_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-39635", "method": "POST", "mode": "block", "severity": 5.4, "slug": "youzify", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2024-39635-02": {"ajax_action": "youzify_reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-39635", "method": "POST", "mode": "block", "severity": 5.4, "slug": "youzify", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2024-39643-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-39643", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.0.1"}, "RULE-CVE-2024-39643-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-39643", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.0.1"}, "RULE-CVE-2024-39643-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-39643", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.0.1"}, "RULE-CVE-2024-4010-03": {"ajax_action": "ig_es_get_subscribers_stats", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4010", "description": "Email Subscribers <=5.7.19 subscriber+ unauthorized access to subscriber stats via ig_es_get_subscribers_stats", "mode": "block", "severity": 8.8, "slug": "email-subscribers", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=5.7.19"}, "RULE-CVE-2024-4010-04": {"ajax_action": "ig_es_trigger_mailing_queue_sending", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4010", "description": "Email Subscribers <=5.7.19 missing authorization on mailing queue trigger via ig_es_trigger_mailing_queue_sending", "mode": "block", "severity": 8.8, "slug": "email-subscribers", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=5.7.19"}, "RULE-CVE-2024-4033-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "aiovg_videos"}, {"name": "ARGS:image", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:\\\\?|#|$)|\\\\.htaccess(?:\\\\?|#|$)~i"}], "cve": "CVE-2024-4033", "description": "All-in-One Video Gallery <=3.6.4 authenticated (contributor+) arbitrary file upload via image parameter in aiovg_videos post save", "mode": "block", "severity": 8.8, "slug": "all-in-one-video-gallery", "target": "plugin", "versions": "<=3.6.4"}, "RULE-CVE-2024-4095-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:expand|colomat|expandsub[0-9]{1,2})\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|%\\\\(%[^%]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4095", "description": "Collapse-O-Matic <=1.8.5.7 contributor+ stored XSS via expand/expandsub/colomat shortcode attributes in post content (classic editor)", "mode": "block", "severity": 6.4, "slug": "jquery-collapse-o-matic", "target": "plugin", "versions": "<=1.8.5.7"}, "RULE-CVE-2024-4095-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:expand|colomat|expandsub[0-9]{1,2})\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|%\\\\(%[^%]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4095", "description": "Collapse-O-Matic <=1.8.5.7 contributor+ stored XSS via expand/expandsub/colomat shortcode attributes in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "jquery-collapse-o-matic", "target": "plugin", "versions": "<=1.8.5.7"}, "RULE-CVE-2024-4098-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/shariff/v1/share_counts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:services", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/])~"}], "cve": "CVE-2024-4098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4098", "description": "Shariff Wrapper <=4.6.13 unauthenticated Local File Inclusion via services parameter in REST API share_counts endpoint", "method": "GET", "mode": "block", "severity": 9.8, "slug": "shariff", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.6.13"}, "RULE-CVE-2024-4160-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdm[_-](?:all[_-]packages|categories)[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4160", "description": "Download Manager <=3.2.90 stored XSS via wpdm-all-packages shortcode attributes", "mode": "block", "severity": 6.4, "slug": "download-manager", "target": "plugin", "versions": "<=3.2.90"}, "RULE-CVE-2024-4180-01": {"ajax_action": "tribe_events_views_v2_fallback", "conditions": [{"name": "ARGS:view", "type": "equals", "value": "reflector"}], "cve": "CVE-2024-4180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4180", "description": "The Events Calendar <=6.4.0 reflected XSS via view=reflector in AJAX fallback handler (POST)", "method": "POST", "mode": "block", "severity": 9.1, "slug": "the-events-calendar", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=6.4.0"}, "RULE-CVE-2024-4180-02": {"ajax_action": "tribe_events_views_v2_fallback", "conditions": [{"name": "ARGS:view", "type": "equals", "value": "reflector"}], "cve": "CVE-2024-4180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4180", "description": "The Events Calendar <=6.4.0 reflected XSS via view=reflector in AJAX fallback handler (GET)", "method": "GET", "mode": "block", "severity": 9.1, "slug": "the-events-calendar", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=6.4.0"}, "RULE-CVE-2024-4223-01": {"ajax_action": "addon_enable_disable", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on addon_enable_disable AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-02": {"ajax_action": "tutor_get_all_addons", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_get_all_addons AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "info-disclosure"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-03": {"ajax_action": "tutor_course_delete", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_course_delete AJAX action allowing arbitrary course deletion", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-04": {"ajax_action": "tutor_announcement_create", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_announcement_create AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-05": {"ajax_action": "tutor_announcement_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_announcement_delete AJAX action allowing arbitrary announcement deletion", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-06": {"ajax_action": "delete_tutor_review", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on delete_tutor_review AJAX action allowing arbitrary review deletion", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tutor/v1/course-by-terms(/|\\\\?|&|$)~"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 unauthorized access to removed REST route /tutor/v1/course-by-terms", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4277-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"name": "ARGS:_elementor_data", "type": "detectXSS"}], "cve": "CVE-2024-4277", "method": "POST", "mode": "block", "severity": 6.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4295-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:hash", "type": "regex", "value": "~(?:\'|%27|%2527)[\\\\s)]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|\\\\d\\\\s*[=<>])~i"}], "cve": "CVE-2024-4295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4295", "description": "Email Subscribers by Icegram Express <=5.7.20 unauthenticated SQL injection via hash parameter on icegram-express AJAX handler", "mode": "block", "severity": 9.8, "slug": "email-subscribers", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7.20"}, "RULE-CVE-2024-43141-01": {"ajax_action": "pdb_list_filter", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2024-43141", "description": "Participants Database <=2.5.9.2 unauthenticated PHP object injection via unsanitized cookie deserialization in pdb_list_filter AJAX handler", "mode": "block", "severity": 9.8, "slug": "participants-database", "target": "plugin", "versions": "<=2.5.9.2"}, "RULE-CVE-2024-43160-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/optifer/v1/store-webp(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43160", "description": "BerqWP <=1.7.6 unauthenticated arbitrary file upload via optifer/v1/store-webp REST route", "method": "POST", "mode": "block", "severity": 10.0, "slug": "searchpro", "tags": ["missing-authorization", "arbitrary-file-upload", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2024-43162-01": {"ajax_action": "edd_customer_details", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-43162-02": {"ajax_action": "edd_customer_addresses", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-43162-03": {"ajax_action": "edd_search_users", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-43162-04": {"ajax_action": "edd_customer_search", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-4318-01": {"ajax_action": "review_quiz_answer", "conditions": [{"name": "ARGS:question_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s|(?:^|[\\\\s\'\\"])(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+)~i"}], "cve": "CVE-2024-4318", "description": "Tutor LMS <=2.7.0 authenticated (Instructor+) time-based SQL injection via question_id in review_quiz_answer AJAX handler", "mode": "block", "severity": 6.5, "slug": "tutor", "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-43302-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "fonts-plugin-typekit"}, {"name": "ARGS:action", "type": "equals", "value": "reset"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43302", "description": "Fonts Plugin | Google Fonts Typography <=3.7.7 missing authorization on Typekit reset action via admin_init", "method": "GET", "mode": "block", "severity": 8.8, "slug": "olympus-google-fonts", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2024-43302-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "fonts-plugin-typekit"}, {"name": "ARGS:action", "type": "equals", "value": "disable"}, {"name": "ARGS:kit_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43302", "description": "Fonts Plugin | Google Fonts Typography <=3.7.7 missing authorization on Typekit disable action via admin_init", "method": "GET", "mode": "block", "severity": 8.8, "slug": "olympus-google-fonts", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2024-43302-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "fonts-plugin-typekit"}, {"name": "ARGS:action", "type": "equals", "value": "enable"}, {"name": "ARGS:kit_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43302", "description": "Fonts Plugin | Google Fonts Typography <=3.7.7 missing authorization on Typekit enable action via admin_init", "method": "GET", "mode": "block", "severity": 8.8, "slug": "olympus-google-fonts", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2024-43304-01": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:requiredCurrencies", "type": "detectXSS"}], "cve": "CVE-2024-43304", "method": "POST", "mode": "block", "severity": 6.1, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-43314-01": {"action": "admin_post_wpacu_bulk_unload", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43314", "description": "Asset CleanUp <=1.3.9.3 missing authorization on wpacu_bulk_unload admin-post action allows Subscriber+ to unload theme/plugin assets", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-asset-clean-up", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=1.3.9.3"}, "RULE-CVE-2024-43317-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son[a-zA-Z0-9_]+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-43317", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.1.0"}, "RULE-CVE-2024-43317-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son[a-zA-Z0-9_]+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-43317", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.1.0"}, "RULE-CVE-2024-43317-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son[a-zA-Z0-9_]+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-43317", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.1.0"}, "RULE-CVE-2024-43328-01": {"ajax_action": "get_viewer", "conditions": [{"name": "ARGS:fid", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2024-43328", "description": "EmbedPress <=4.0.9 unauthenticated PHP local file inclusion via fid parameter in get_viewer AJAX handler", "mode": "block", "severity": 9.8, "slug": "embedpress", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2024-43328-02": {"ajax_action": "youtube_rest_api", "conditions": [{"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-43328", "description": "EmbedPress <=4.0.9 unauthenticated access to youtube_rest_api AJAX handler (nopriv removed in patch)", "mode": "block", "severity": 9.8, "slug": "embedpress", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2024-4334-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~dsm_typing_effect[^\\\\]]*typing_cursor\\\\s*=\\\\s*(?:\\"[^\\"]*|\'[^\']*|[^\\\\s\\\\]]*)(?:]|on(?:error|load|mouseover|click|animationstart|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4334", "description": "Supreme Modules Lite <=2.5.3 contributor+ DOM-Based Stored XSS via typing_cursor in TypingEffect module shortcode", "mode": "block", "severity": 6.4, "slug": "supreme-modules-for-divi", "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2024-4347-01": {"ajax_action": "wpfc_delete_cache", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2024-4347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4347", "description": "WP Fastest Cache <=1.2.6 authenticated arbitrary file deletion via path traversal in wpfc_delete_cache", "mode": "block", "severity": 7.2, "slug": "wp-fastest-cache", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2024-4360-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~title_tag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:\\\\s+on[a-z]+=|]|javascript\\\\s*:|]|]|on[a-z]+\\\\s*=|javascript\\\\s*:|\\"\\\\s+[a-z])|\'[^\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:|\'\\\\s+[a-z])|[^\\\\s\\\\]\\"\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:))~i"}], "cve": "CVE-2024-4362", "description": "SiteOrigin Widgets Bundle <=1.60.0 contributor+ stored XSS via siteorigin_widget shortcode class attribute (post.php save path)", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.60.0"}, "RULE-CVE-2024-4362-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[siteorigin_widget\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*(?:\\"[^\\"]*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:|\\"\\\\s+[a-z])|\'[^\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:|\'\\\\s+[a-z])|[^\\\\s\\\\]\\"\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:))~i"}], "cve": "CVE-2024-4362", "description": "SiteOrigin Widgets Bundle <=1.60.0 contributor+ stored XSS via siteorigin_widget shortcode in REST post update", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.60.0"}, "RULE-CVE-2024-4366-01": {"ajax_action": "uag_load_image_gallery_masonry", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:block_id", "type": "detectXSS"}], "cve": "CVE-2024-4366", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2024-4366-02": {"ajax_action": "uag_load_image_gallery_grid_pagination", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:block_id", "type": "detectXSS"}], "cve": "CVE-2024-4366", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2024-4375-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ms_layer\\\\b[^\\\\]]*css_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on\\\\w+\\\\s*=|]|javascript\\\\s*:|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4375", "description": "Master Slider <=3.9.10 contributor+ stored XSS via ms_layer shortcode css_id attribute", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.9.10"}, "RULE-CVE-2024-4389-01": {"ajax_action": "depicter_upload_file", "conditions": [{"name": "REQUEST_HEADERS:Content-Type", "type": "contains", "value": "multipart/form-data"}, {"name": "ARGS:filename", "type": "regex", "value": "~(?i)\\\\.(php[0-9]?|phtml|phps|phar)(?:$|\\\\.)~i"}], "cve": "CVE-2024-4389", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4389", "description": "Depicter <= 3.1.1 allows authenticated Contributor+ users to upload arbitrary PHP files through its media upload functionality that ultimately calls Depicter\\\\WordPress\\\\FileUploaderService::uploadFile(), which before 3.1.2 accepted attacker-controlled filenames and moved them into the uploads directory without blocking .php extensions; 3.1.2 fixes this by sanitizing the filename and rejecting uploads whose sanitized name ends with .php, so this rule is implemented as a role-agnostic hardening control bound to the confirmed Depicter AJAX upload action and blocks multipart upload requests where the client-supplied filename parameter ends in a PHP-family extension (.php, .php0\\u2013.php9, .phtml, .phps, .phar, including double-extension tricks like image.php.jpg), while allowing benign image/media uploads for all roles.\\n", "method": "POST", "mode": "block", "severity": 9.8, "slug": "depicter", "tags": ["wp-plugin", "file-upload", "rce", "authenticated"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2024-43924-01": {"ajax_action": "save-attachment-compat", "conditions": [{"name": "ARGS:attachment_ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-43924", "mode": "block", "severity": 9.8, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-43924-02": {"ajax_action": "rl-folders-move-attachments", "conditions": [{"name": "ARGS:attachment_ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-43924", "mode": "block", "severity": 9.8, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-43924-03": {"ajax_action": "rl-deactivate-plugin", "conditions": [{"name": "ARGS:section", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2024-43924", "mode": "block", "severity": 9.8, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-4397-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lp/v1/(?:material/)?item-materials/[0-9]+(?:/|\\\\?|$)~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|jsp|as(?:p|px)|exe|sh|bat)$~i"}], "cve": "CVE-2024-4397", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4397", "description": "LearnPress <=4.2.6.5 authenticated arbitrary file upload via REST item-materials endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "learnpress", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-43977-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"video_date\\" *: *\\"[^\\"]*(?:\\\\\\\\\\"[^\\"]*?(?:on[a-zA-Z0-9_]+ *=|autofocus|style *=|src *=|href *=)|[<>])~i"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via video_date in tp-video-player widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-43977-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"carousel_direction\\" *: *\\"[^\\"]*[ =<>]~i"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via carousel_direction in tp-testimonial-listout widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-43977-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"res_width_value\\" *: *\\"[^\\"]*\'~"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via res_width_value in tp-page-scroll widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-43977-04": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"nav_dots_tooltips\\" *: *\\"[^\\"]*\'(?: {0,3}(?:on[a-zA-Z0-9_]+ *=|style *=|src *=|href *=)| *autofocus(?:[ /]|$)|><)~i"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via nav_dots_tooltips in tp-page-scroll widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-4413-01": {"action": "init", "conditions": [{"name": "ARGS:mphb_rooms_details", "type": "regex", "value": "~[OC]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-4413", "method": "POST", "mode": "block", "severity": 9.8, "slug": "motopress-hotel-booking-lite", "target": "plugin", "versions": "<=4.11.1"}, "RULE-CVE-2024-4434-01": {"action": "init", "conditions": [{"name": "ARGS:term_id", "type": "exists"}, {"name": "ARGS:term_id", "type": "detectSQLi"}], "cve": "CVE-2024-4434", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4434", "description": "LearnPress <= 4.2.6.5 unauthenticated time-based SQL injection via term_id in public course/category listings (Wordfence/NVD: term_id SQLi, unauthenticated, CWE-89)", "method": "GET", "mode": "block", "severity": 9.8, "slug": "learnpress", "tags": ["sqli", "unauth", "learnpress", "term_id"], "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4439-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-comments-post\\\\.php(?:[/?]|$)~i"}, {"name": "ARGS:author", "type": "regex", "value": "~[\\"\'][\\\\s/]*(?:on[a-z]{3,15}|style|href|src|formaction)[\\\\s]*=~i"}], "cve": "CVE-2024-4439", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4439", "description": "Unauthenticated stored XSS in WordPress core 6.5 / 6.5.1 Avatar block. wp-includes/blocks/avatar.php builds the anchor\'s aria-label with sprintf( esc_attr__( \'(%s website link, opens in a new tab)\' ), $comment->comment_author ) - esc_attr__() escapes the static format string BEFORE sprintf() splices in the comment author name, so the author value itself is never escaped. wp_handle_comment_submission() only applies strip_tags() to the author name (wp-includes/comment.php:3473), which removes angle brackets but not quotes, so a double quote closes the aria-label attribute early and any following name=value pair becomes a new attribute on the same tag. Fixed in 6.5.2 by moving esc_attr() outside the sprintf().", "method": "POST", "mode": "block", "severity": 6.1, "tags": ["xss", "wp-core", "comments", "unauthenticated"], "target": "core", "versions": ">=6.5 <6.5.2"}, "RULE-CVE-2024-4443-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~listingfields(?:%5[Bb]|\\\\[)(?![0-9]+(?:%5[Dd]|\\\\]))~"}], "cve": "CVE-2024-4443", "method": "GET", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2024-4443-02": {"action": "init", "conditions": [{"name": "ARGS:listingfields", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?i)(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT)|(?:SELECT\\\\s+.+FROM)|(?:INSERT\\\\s+INTO)|(?:DELETE\\\\s+FROM)|(?:UPDATE\\\\s+.+SET)|(?:DROP\\\\s+TABLE)|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE)~"}], "cve": "CVE-2024-4443", "method": "POST", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2024-4443-03": {"action": "init", "conditions": [{"name": "ARGS:listingfields", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?i)(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT)|(?:SELECT\\\\s+.+FROM)|(?:INSERT\\\\s+INTO)|(?:DELETE\\\\s+FROM)|(?:UPDATE\\\\s+.+SET)|(?:DROP\\\\s+TABLE)|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE)~"}], "cve": "CVE-2024-4443", "method": "GET", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2024-4444-01": {"action": "init", "conditions": [{"name": "ARGS:lp-ajax", "type": "equals", "value": "checkout"}, {"name": "ARGS:checkout-email-option", "type": "equals", "value": "new-account"}], "cve": "CVE-2024-4444", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4444-02": {"ajax_action": "learnpress-checkout", "conditions": [{"name": "ARGS:checkout-email-option", "type": "equals", "value": "new-account"}], "cve": "CVE-2024-4444", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4444-03": {"ajax_action": "learnpress_checkout", "conditions": [{"name": "ARGS:checkout-email-option", "type": "equals", "value": "new-account"}], "cve": "CVE-2024-4444", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4470-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[ms_slide_info\\\\b[^\\\\]]*tag_name\\\\s*=\\\\s*[\\"\']?(?!(?:h[1-4]|div|span)[\\"\'\\\\s\\\\]])[^\\"\'\\\\]]+~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4470", "description": "Master Slider <=3.9.9 stored XSS via ms_slide_info shortcode tag_name attribute", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.9.9"}, "RULE-CVE-2024-4489-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:async-upload\\\\.php|media-new\\\\.php)~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~<(?:script[\\\\s/>]|[^>]*\\\\bon(?:load|error|click|mouseover|focus)\\\\s*=|foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-4489", "description": "Royal Elementor Addons <=1.3.976 stored XSS via malicious SVG file upload through async-upload.php", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.3.976"}, "RULE-CVE-2024-4489-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~<(?:script[\\\\s/>]|[^>]*\\\\bon(?:load|error|click|mouseover|focus)\\\\s*=|foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-4489", "description": "Royal Elementor Addons <=1.3.976 stored XSS via malicious SVG file upload through REST media endpoint", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.3.976"}, "RULE-CVE-2024-4560-01": {"ajax_action": "chatbot_chatgpt_upload_file_to_assistant", "conditions": [{"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2024-4560", "method": "POST", "mode": "block", "severity": 9.8, "slug": "chatbot-chatgpt", "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2024-4624-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:eael_ext_toc_title_tag", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|(?:^|[\\\\s/])on\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-4624", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.20"}, "RULE-CVE-2024-4711-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ajax_load_more[^\\\\]]*button_label\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-4711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4711", "description": "Ajax Load More <=7.1.1 stored XSS via ajax_load_more shortcode button_label attribute", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-load-more", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-4711-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ajax_load_more[^\\\\]]*container_type\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-4711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4711", "description": "Ajax Load More <=7.1.1 stored XSS via ajax_load_more shortcode container_type attribute", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-load-more", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-4711-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ajax_load_more[^\\\\]]*class\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-4711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4711", "description": "Ajax Load More <=7.1.1 stored XSS via ajax_load_more shortcode class attribute", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-load-more", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-4711-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ajax_load_more\\\\b[^\\\\]]*\\\\b(?:button_label|container_type|css_classes)\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]+onload\\\\s*=|])~i"}], "cve": "CVE-2024-4971", "description": "LearnPress <=4.2.6.6 reflected XSS via id parameter in admin question editor", "mode": "block", "severity": 6.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.6"}, "RULE-CVE-2024-4984-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit|user-new)\\\\.php~"}, {"name": "ARGS:display_name", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur|mouseenter|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|video|audio|object|embed|details|marquee|body)[\\\\s/>]|[\\"\'][^\\"\'<>]*[\\"\']?\\\\s+on[a-z]+\\\\s*=)~i"}], "cve": "CVE-2024-4984", "description": "Yoast SEO <=22.6 stored XSS via author display_name rendered unescaped in Slack/OpenGraph meta tags", "mode": "block", "severity": 6.4, "slug": "wordpress-seo", "target": "plugin", "versions": "<=22.6"}, "RULE-CVE-2024-5020-01": {"ajax_action": "accordion_slider_save_accordion", "conditions": [{"name": "ARGS:data", "type": "detectXSS"}], "cve": "CVE-2024-5020", "method": "POST", "mode": "block", "severity": 6.4, "slug": "accordion-slider", "target": "plugin", "versions": "<=1.9.12"}, "RULE-CVE-2024-5020-02": {"ajax_action": "accordion_slider_preview_accordion", "conditions": [{"name": "ARGS:data", "type": "detectXSS"}], "cve": "CVE-2024-5020", "method": "POST", "mode": "block", "severity": 6.4, "slug": "accordion-slider", "target": "plugin", "versions": "<=1.9.12"}, "RULE-CVE-2024-5020-03": {"ajax_action": "accordion_slider_import_accordion", "conditions": [{"name": "ARGS:data", "type": "detectXSS"}], "cve": "CVE-2024-5020", "method": "POST", "mode": "block", "severity": 6.4, "slug": "accordion-slider", "target": "plugin", "versions": "<=1.9.12"}, "RULE-CVE-2024-50413-01": {"ajax_action": "acui_email_template_selected", "conditions": [{"name": "ARGS:template_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50413", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50413", "description": "Import Users from CSV with Meta <=1.27.5 stored XSS via acui_email_template_selected", "mode": "block", "severity": 5.9, "slug": "import-users-from-csv-with-meta", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.27.5"}, "RULE-CVE-2024-50413-02": {"ajax_action": "acui_send_test_email", "conditions": [{"name": "ARGS:mail_options_subject", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50413", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50413", "description": "Import Users from CSV with Meta <=1.27.5 stored XSS via acui_send_test_email", "mode": "block", "severity": 5.9, "slug": "import-users-from-csv-with-meta", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.27.5"}, "RULE-CVE-2024-50413-03": {"ajax_action": "acui_mail_options_remove_attachment", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50413", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50413", "description": "Import Users from CSV with Meta <=1.27.5 stored XSS via acui_mail_options_remove_attachment", "mode": "block", "severity": 5.9, "slug": "import-users-from-csv-with-meta", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.27.5"}, "RULE-CVE-2024-50477-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/.*activate-new-password(?:/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50477", "description": "Stacks Mobile App Builder <=5.2.3 unauthenticated account takeover via forgot-password REST endpoint missing permission_callback", "method": "POST", "mode": "block", "severity": 9.8, "slug": "stacks-mobile-app-builder", "target": "plugin", "versions": "<=5.2.3"}, "RULE-CVE-2024-50477-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/avaris-wc-rest/v3/receive_builder_image(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|user\\\\.ini)$|\\\\.htaccess$~i"}], "cve": "CVE-2024-50477", "description": "Stacks Mobile App Builder <=5.2.3 unauthenticated arbitrary file upload via receive_builder_image REST endpoint missing permission_callback", "method": "POST", "mode": "block", "severity": 9.8, "slug": "stacks-mobile-app-builder", "target": "plugin", "versions": "<=5.2.3"}, "RULE-CVE-2024-50500-01": {"ajax_action": "auxin_templates_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_templates_data AJAX handler allowing subscriber+ access to demo importer", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-02": {"ajax_action": "auxin_demo_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_demo_data AJAX handler allowing subscriber+ demo import", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-03": {"ajax_action": "import_step", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on import_step AJAX handler allowing subscriber+ demo import step execution", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-04": {"ajax_action": "auxin_template_control_importer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_template_control_importer AJAX handler allowing subscriber+ template control", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-05": {"ajax_action": "aux_ajax_lightbox", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_ajax_lightbox AJAX handler allowing subscriber+ access with XSS via preview param", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control", "xss"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-06": {"ajax_action": "aux_setup_plugins", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_setup_plugins AJAX handler allowing subscriber+ plugin installation", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-07": {"ajax_action": "aux_step_manager", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_step_manager AJAX handler allowing subscriber+ setup wizard access", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-08": {"ajax_action": "aux_ajax_uninstall", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_ajax_uninstall AJAX handler allowing subscriber+ plugin uninstall actions", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-09": {"ajax_action": "auxin_customizer_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_customizer_import AJAX handler allowing subscriber+ customizer import", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-5090-01": {"ajax_action": "so_widgets_links_get_title", "conditions": [{"name": "ARGS:postId", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|marquee|body|input|form)\\\\b|&#x?[0-9a-f]+;?\\\\s*<|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-5090", "description": "SiteOrigin Widgets Bundle <=1.61.1 reflected XSS via postId in so_widgets_links_get_title AJAX handler (DCA-confirmed taint flow base/base.php:391->392).", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.61.1"}, "RULE-CVE-2024-5147-01": {"ajax_action": "wpz_posts_grid_load_more", "conditions": [{"name": "ARGS:posts_data", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2024-5147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5147", "description": "WPZOOM Addons for Elementor <=1.1.37 unauthenticated Local File Inclusion via path traversal in posts_data JSON parameter on wpz_posts_grid_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpzoom-elementor-addons", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.1.37"}, "RULE-CVE-2024-51661-01": {"ajax_action": "mla_named_transfer", "conditions": [{"name": "ARGS:mla_item", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-51661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-51661", "description": "Media Library Assistant <=3.19 missing authorization on mla_named_transfer AJAX action exposing unauthenticated file transfer sinks", "mode": "block", "severity": 9.1, "slug": "media-library-assistant", "tags": ["missing-authorization", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=3.19"}, "RULE-CVE-2024-51667-01": {"ajax_action": "paytium_emails_attachments", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-51667", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paytium", "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2024-51793-01": {"ajax_action": "wc_upload_file_ajax", "conditions": [{"name": "FILES:file", "type": "exists"}], "cve": "CVE-2024-51793", "description": "Block unauthenticated arbitrary file upload via wc_upload_file_ajax AJAX handler in RepairBuddy plugin (CWE-434). The handler registers both wp_ajax and wp_ajax_nopriv hooks with no authentication, nonce, or file-type validation, allowing anonymous PHP web shell upload leading to RCE. This rule blocks any request carrying a file upload to that endpoint, since the nopriv hook means no legitimate unauthenticated use case exists for this dangerous upload handler.", "mode": "block", "severity": 10.0, "slug": "computer-repair-shop", "target": "plugin", "versions": "<=3.8115"}, "RULE-CVE-2024-5207-01": {"ajax_action": "ps-get-email-logs", "conditions": [{"name": "ARGS:selected", "type": "regex", "value": "~(?:[\\\\(\\\\)\\"\'`]|\\\\bSLEEP\\\\b|\\\\bSELECT\\\\b|\\\\bIF\\\\b|\\\\bCASE\\\\b|\\\\bWHEN\\\\b|\\\\bUNION\\\\b|\\\\bBENCHMARK\\\\b|/\\\\*|\\\\*/|;)~i"}], "cve": "CVE-2024-5207", "description": "Post SMTP <=2.9.3 authenticated SQL injection via selected parameter in ps-get-email-logs AJAX handler", "mode": "block", "severity": 7.2, "slug": "post-smtp", "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2024-5222-01": {"ajax_action": "responsive-ready-sites-import-xml", "conditions": [{"name": "ARGS:xml_data", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-5222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5222", "description": "Responsive Add-ons <=3.0.5 stored XSS via WXR import xml_data parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-add-ons", "tags": ["xss", "stored", "authenticated", "file-upload"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2024-5222-02": {"ajax_action": "responsive-ready-sites-import-sites", "conditions": [{"name": "ARGS:site_data", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-5222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5222", "description": "Responsive Add-ons <=3.0.5 stored XSS via site template import site_data parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-add-ons", "tags": ["xss", "stored", "authenticated", "file-upload"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2024-5222-03": {"ajax_action": "responsive-ready-sites-import-wpforms", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-5222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5222", "description": "Responsive Add-ons <=3.0.5 stored XSS via wpforms import form_data parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-add-ons", "tags": ["xss", "stored", "authenticated", "file-upload"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2024-52500-01": {"ajax_action": "create_zone", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on create_zone AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-52500-02": {"ajax_action": "update_logged_in_disabled", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on update_logged_in_disabled AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-52500-03": {"ajax_action": "update_zone_enabled_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on update_zone_enabled_option AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-52500-04": {"ajax_action": "update_zone_id_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on update_zone_id_option AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-5266-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpdm_(?:packages|package|user_dashboard|search_result|tag)\\\\s[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-5266", "description": "Download Manager <=3.2.92 contributor+ stored XSS via wpdm shortcode attributes in post_content (classic editor)", "mode": "block", "severity": 6.4, "slug": "download-manager", "target": "plugin", "versions": "<=3.2.92"}, "RULE-CVE-2024-5266-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdm_(?:packages|package|user_dashboard|search_result|tag)\\\\s[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-5266", "description": "Download Manager <=3.2.92 contributor+ stored XSS via wpdm shortcode attributes in post content (Gutenberg REST API)", "mode": "block", "severity": 6.4, "slug": "download-manager", "target": "plugin", "versions": "<=3.2.92"}, "RULE-CVE-2024-5317-01": {"ajax_action": "tnp", "conditions": [{"name": "ARGS:na", "type": "regex", "value": "~^(?:s|ps|profile-save|profile_export)$~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|toggle|animationend)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:svg|img|iframe|video|audio|object|embed|details|marquee|body)\\\\b)~i"}], "cve": "CVE-2024-5317", "description": "Newsletter <=8.3.4 unauthenticated stored XSS via np1/np-family profile fields on tnp AJAX action", "mode": "block", "severity": 6.1, "slug": "newsletter", "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2024-5317-02": {"action": "init", "conditions": [{"name": "ARGS:na", "type": "regex", "value": "~^(?:s|ps|profile-save|profile_export)$~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|toggle|animationend)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:svg|img|iframe|video|audio|object|embed|details|marquee|body)\\\\b)~i"}], "cve": "CVE-2024-5317", "description": "Newsletter <=8.3.4 unauthenticated stored XSS via np1/np-family profile fields on public subscribe form (newsletter_action)", "mode": "block", "severity": 6.1, "slug": "newsletter", "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2024-5324-01": {"ajax_action": "xoo_admin_settings_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-5324", "mode": "block", "severity": 8.8, "slug": "mobile-login-woocommerce", "target": "plugin", "versions": "<=2.6.1"}, "RULE-CVE-2024-5329-01": {"ajax_action": "unitecreator_elementor_get_categories", "conditions": [{"name": "ARGS:data[addonID]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|\\\\bOR\\\\b\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-5329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5329", "description": "Unlimited Elements for Elementor <=1.5.109 authenticated (contributor+) blind SQL injection via data[addonID]", "mode": "block", "severity": 8.8, "slug": "unlimited-elements-for-elementor", "tags": ["sql-injection", "authenticated", "blind-sql-injection"], "target": "plugin", "versions": "<=1.5.109"}, "RULE-CVE-2024-5349-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:map_style", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~i"}], "cve": "CVE-2024-5349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5349", "description": "LA-Studio Element Kit for Elementor <=1.3.8.1 Local File Inclusion via map_style parameter in Google Maps widget", "mode": "block", "severity": 8.8, "slug": "lastudio-element-kit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.3.8.1"}, "RULE-CVE-2024-54268-01": {"ajax_action": "so_widgets_search_posts", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "so_widgets_search_posts"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-54268", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-54268", "description": "Broken access control in SiteOrigin Widgets Bundle so_widgets_search_posts AJAX action allowing low-privileged users to trigger privileged widget searches via admin-ajax.php", "mode": "block", "severity": 8.8, "slug": "so-widgets-bundle", "tags": ["wordpress", "ajax", "missing_authorization", "broken_access_control"], "target": "plugin", "versions": "<=1.64.0"}, "RULE-CVE-2024-54282-01": {"ajax_action": "wpmm_nav_menu_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_nav_menu_save AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-02": {"ajax_action": "wpmm_save_layout", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_save_layout AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-03": {"ajax_action": "wpmm_save_widget", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_save_widget AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-04": {"ajax_action": "wpmm_menu_item_option_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_menu_item_option_save AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-05": {"ajax_action": "wpmm_theme_delete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_theme_delete AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-06": {"ajax_action": "export_wpmm_theme", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via export_wpmm_theme AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^wp-megamenu(?:-import|-export|-themes|-settings)?$~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wp-megamenu admin import/export pages (CWE-502)", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-5441-01": {"ajax_action": "mec_fes_form", "conditions": [{"name": "ARGS:mec[featured_image]", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|tml?|ar|t)|shtml?|cgi|fcgi|asp|aspx|jsp|exe|bash|ht(?:access|passwd))(?:[?#/]|$)~i"}], "cve": "CVE-2024-5441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5441", "description": "Modern Events Calendar Lite <=6.5.6 arbitrary file upload via mec[featured_image] URL parameter in wp_ajax(_nopriv)_mec_fes_form \\u2014 set_featured_image() downloads attacker URL unchecked (CWE-434)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "modern-events-calendar-lite", "target": "plugin", "versions": "<=6.5.6"}, "RULE-CVE-2024-5450-01": {"action": "init", "conditions": [{"name": "ARGS:new-bug-title", "type": "exists"}, {"name": "FILES:attachimage", "type": "exists"}], "cve": "CVE-2024-5450", "method": "POST", "mode": "block", "severity": 9.1, "slug": "bug-library", "target": "plugin", "versions": "<2.1.1"}, "RULE-CVE-2024-5488-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/seopress/v1/posts/\\\\d+/(?:preview-)?title-description-metas(/|\\\\?|$)~"}, {"name": "ARGS:title", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5488", "description": "SEOPress <=7.8 unauthenticated PHP object injection via title parameter on REST preview-title-description-metas route", "mode": "block", "severity": 9.8, "slug": "wp-seopress", "tags": ["object-injection", "deserialization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<7.9"}, "RULE-CVE-2024-5488-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/seopress/v1/posts/\\\\d+/(?:preview-)?title-description-metas(/|\\\\?|$)~"}, {"name": "ARGS:description", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5488", "description": "SEOPress <=7.8 unauthenticated PHP object injection via description parameter on REST preview-title-description-metas route", "mode": "block", "severity": 9.8, "slug": "wp-seopress", "tags": ["object-injection", "deserialization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<7.9"}, "RULE-CVE-2024-5488-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/seopress/v1/posts/\\\\d+/content-analysis(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5488", "description": "SEOPress <=7.8 unauthenticated PHP object injection via content-analysis REST route triggering deserialization", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wp-seopress", "tags": ["object-injection", "deserialization", "unauthenticated", "rest-api", "missing-authorization"], "target": "plugin", "versions": "<7.9"}, "RULE-CVE-2024-5488-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/seopress/v1/posts/\\\\d+/~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5488", "description": "SEOPress <=7.8 unauthenticated PHP object injection via any parameter on seopress REST post routes", "mode": "block", "severity": 9.8, "slug": "wp-seopress", "tags": ["object-injection", "deserialization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<7.9"}, "RULE-CVE-2024-5501-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~button_(?:one|two)_id\\\\s*=\\\\s*(?:\\"|%22)(?:[^\\"]*?)(?:on(?:mouse(?:over|enter|leave|down|up|move)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|animation(?:start|end|iteration)|transition(?:end|run))|(?:]|%(?:20|3[Ee]|2[Ff]))|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-5501", "description": "Supreme Modules Lite <=2.5.51 contributor+ stored XSS via button_one_id/button_two_id shortcode attributes in post content", "mode": "block", "severity": 6.4, "slug": "supreme-modules-for-divi", "target": "plugin", "versions": "<=2.5.51"}, "RULE-CVE-2024-5522-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/video/v1/singlevideo~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\'\\\\s*(?:OR|AND)\\\\s+\'|--\\\\s*$)~i"}], "cve": "CVE-2024-5522", "description": "Blocks unauthenticated SQL injection via the \'id\' parameter on the REST route /wp-json/video/v1/singlevideo. The vulnerable plugin passes the id parameter to a SQL query without sanitization or use of $wpdb->prepare(). The fix applies input validation/sanitization. This rule detects SQL injection payloads in the id parameter on the public REST endpoint.", "mode": "block", "severity": 6.5, "slug": "html5-video-player", "target": "plugin", "versions": "<2.5.27"}, "RULE-CVE-2024-56063-01": {"ajax_action": "save_settings_with_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-56063", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-56063", "description": "Essential Addons for Elementor <=6.0.7 stored XSS via unescaped get_option-backed content (Countdown/Login_Register widgets) written through the plugin\'s save_settings_with_ajax handler", "mode": "block", "severity": 6.5, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.0.7"}, "RULE-CVE-2024-56226-01": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_ajax_search_link_target", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form|marquee|isindex|keygen|base)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_ajax_search_link_target parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56226-02": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_no_results", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_no_results parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56226-03": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_view_result_text", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_view_result_text parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56226-04": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_number_of_words", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_number_of_words parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56276-01": {"ajax_action": "wpforms_lite_settings_upgrade", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-56276", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpforms-lite", "target": "plugin", "versions": "<=1.9.2.2"}, "RULE-CVE-2024-56288-01": {"ajax_action": "wpdocs_update_option", "conditions": [{"name": "ARGS:wpd_home_id", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-56288", "method": "POST", "mode": "block", "severity": 4.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-56288-02": {"ajax_action": "wpdocs_update_option", "conditions": [{"name": "ARGS:wpd_get_permalink", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-56288", "method": "POST", "mode": "block", "severity": 4.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-56288-03": {"ajax_action": "wpdocs_update_folder", "conditions": [{"name": "ARGS:new_name", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-56288", "method": "POST", "mode": "block", "severity": 4.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-5667-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "POST", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5667-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "POST", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5667-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5667-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5756-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:db", "type": "detectSQLi"}], "cve": "CVE-2024-5756", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5756", "description": "Email Subscribers by Icegram Express <=5.7.23 unauthenticated SQL injection via db parameter in icegram-express AJAX handler", "mode": "block", "severity": 9.8, "slug": "email-subscribers", "tags": ["sql-injection", "unauthenticated", "time-based-sqli"], "target": "plugin", "versions": "<=5.7.23"}, "RULE-CVE-2024-5853-01": {"ajax_action": "sirv_upload_file_by_chanks", "conditions": [{"name": "ARGS:partFileName", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)~i"}], "cve": "CVE-2024-5853", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sirv", "target": "plugin", "versions": "<=7.2.6"}, "RULE-CVE-2024-5901-01": {"ajax_action": "so_widgets_setting_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:load|error|click|mouseover|mouseout|focus|blur|submit|change|input|keydown|keyup|keypress|toggle|animationend)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|<\\\\s*(?:iframe|svg|img|object|embed|form|math|video|audio|source|details|marquee|body|style|link|meta|base)[\\\\s/>]|srcdoc\\\\s*=|formaction\\\\s*=)~i"}], "cve": "CVE-2024-5901", "description": "SiteOrigin Widgets Bundle <=1.62.2 contributor+ stored XSS in Image Grid widget via so_widgets_setting_save instance attributes", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.62.2"}, "RULE-CVE-2024-5901-02": {"ajax_action": "so_widgets_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:load|error|click|mouseover|mouseout|focus|blur|submit|change|input|keydown|keyup|keypress|toggle|animationend)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|<\\\\s*(?:iframe|svg|img|object|embed|form|math|video|audio|source|details|marquee|body|style|link|meta|base)[\\\\s/>]|srcdoc\\\\s*=|formaction\\\\s*=)~i"}], "cve": "CVE-2024-5901", "description": "SiteOrigin Widgets Bundle <=1.62.2 contributor+ stored XSS in Image Grid widget via so_widgets_preview instance attributes", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.62.2"}, "RULE-CVE-2024-5932-02": {"action": "init", "conditions": [{"name": "ARGS:give_title", "type": "exists"}, {"name": "ARGS:give_title", "type": "regex", "value": "~(^|;)O:[0-9]+:\\\\\\"[A-Za-z0-9_\\\\\\\\]+\\\\\\\\TCPDF\\\\\\":~"}], "cve": "CVE-2024-5932", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2024-5939-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-onboarding-wizard"}, {"type": "missing_capability", "value": "manage_give_settings"}], "cve": "CVE-2024-5939", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5939", "description": "GiveWP <=3.13.0 missing authorization (CWE-862) on the onboarding wizard admin page. Give\\\\Onboarding\\\\Wizard\\\\Page::setup_wizard() is hooked on admin_init (src/ServiceProviders/Onboarding.php:68) and renders the wizard whenever $_GET[\'page\'] equals give-onboarding-wizard, guarded only by the slug comparison at src/Onboarding/Wizard/Page.php:80 \\u2014 no capability check. Any admin entry script that reaches admin_init without loading wp-admin/menu.php therefore renders the wizard \\u2014 admin-post.php:27 and admin-ajax.php:45 both fire admin_init with no auth_redirect(), so an anonymous visitor, and equally a subscriber or editor, reads the wizard and the giveOnboardingWizardData blob (wp_rest nonce, admin e-mail, site settings). Via wp-admin/admin.php the exposure is bounded to roles holding manage_options, because wp-admin/includes/menu.php:380 wp_die()s 403 at admin.php:163 before admin_init at :180. 3.14.0 adds current_user_can(\'manage_give_settings\') to the same guard.", "mode": "block", "severity": 5.3, "slug": "give", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/event/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "POST", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-01-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/event/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PATCH", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-01-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/event/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/ticket-type/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "POST", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-02-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/ticket-type/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PATCH", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-02-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/ticket-type/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5941-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/give-api/v2/donor-dashboard/avatar(?:/|\\\\?|$)|(?:^|[?&])rest_route=/give-api/v2/donor-dashboard/avatar)~i"}, {"name": "ARGS:avatarId", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5941", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2024-5977-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5977-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "DELETE", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5977-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5977-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-6028-01": {"action": "init", "conditions": [{"name": "ARGS:ays_questions", "type": "regex", "value": "~(?:[^0-9, ].*[^0-9, ]|(?:UNION|SELECT|SLEEP|BENCHMARK|OR|AND|INSERT|UPDATE|DELETE|DROP|CONCAT|CHAR|0x[0-9a-fA-F]{2}|/\\\\*|\\\\*/|--)\\\\s)~i"}], "cve": "CVE-2024-6028", "method": "POST", "mode": "block", "severity": 9.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.5.8.3"}, "RULE-CVE-2024-6088-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/learnpress/v1/(?:users/)?register(?:[/?&#]|$)|[?&]rest_route=/learnpress/v1/(?:users/)?register(?:[/?&#]|$))~i"}], "cve": "CVE-2024-6088", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.1"}, "RULE-CVE-2024-6265-01": {"action": "init", "conditions": [{"name": "ARGS:uwp_sort_by", "type": "detectSQLi"}], "cve": "CVE-2024-6265", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6265", "description": "UsersWP <=1.2.10 unauthenticated SQL injection via uwp_sort_by parameter on front-end users page", "mode": "block", "severity": 9.8, "slug": "userswp", "tags": ["sql-injection", "unauthenticated", "order-by-injection"], "target": "plugin", "versions": "<=1.2.10"}, "RULE-CVE-2024-6265-02": {"ajax_action": "uwp_ajax_user_sorting_action", "conditions": [{"name": "ARGS:uwp_sort_by", "type": "detectSQLi"}], "cve": "CVE-2024-6265", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6265", "description": "UsersWP <=1.2.10 unauthenticated SQL injection via uwp_sort_by on AJAX user sorting handler", "mode": "block", "severity": 9.8, "slug": "userswp", "tags": ["sql-injection", "unauthenticated", "order-by-injection", "ajax"], "target": "plugin", "versions": "<=1.2.10"}, "RULE-CVE-2024-6328-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/firebase_sms_login(/|\\\\?|&|$)~"}], "cve": "CVE-2024-6328", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mstore-api", "target": "plugin", "versions": "<=4.14.7"}, "RULE-CVE-2024-6328-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/firebase_sms_login_v2(/|\\\\?|&|$)~"}], "cve": "CVE-2024-6328", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mstore-api", "target": "plugin", "versions": "<=4.14.7"}, "RULE-CVE-2024-6330-01": {"ajax_action": "gmw_info_window_init", "conditions": [{"name": "ARGS:form[info_window_template][content_path]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[a-z]+://|^/)~i"}], "cve": "CVE-2024-6330", "method": "POST", "mode": "block", "severity": 9.8, "slug": "geo-my-wp", "target": "plugin", "versions": "<4.5.0.2"}, "RULE-CVE-2024-6353-01": {"ajax_action": "draw_wallet_transaction_details_table", "conditions": [{"name": "ARGS:search[value]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|CONCAT\\\\s*\\\\(\\\\s*0x|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2024-6353", "description": "Wallet for WooCommerce <=1.5.4 authenticated SQL injection via search[value] in draw_wallet_transaction_details_table", "mode": "block", "severity": 8.8, "slug": "woo-wallet", "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2024-6353-02": {"ajax_action": "draw_wallet_transaction_details_table", "conditions": [{"name": "ARGS:order[0][column]", "type": "regex", "value": "~(?:SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s|\\\\(SELECT\\\\s)~i"}], "cve": "CVE-2024-6353", "description": "Wallet for WooCommerce <=1.5.4 authenticated SQL injection via order[0][column] in draw_wallet_transaction_details_table", "mode": "block", "severity": 8.8, "slug": "woo-wallet", "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2024-6353-03": {"ajax_action": "draw_wallet_transaction_details_table", "conditions": [{"name": "ARGS:order[0][dir]", "type": "regex", "value": "~(?:,\\\\s*\\\\(?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s|(?:^|\\\\s)(?!ASC$|DESC$)[A-Z]{3,}\\\\s)~i"}], "cve": "CVE-2024-6353", "description": "Wallet for WooCommerce <=1.5.4 authenticated SQL injection via order[0][dir] in draw_wallet_transaction_details_table", "mode": "block", "severity": 8.8, "slug": "woo-wallet", "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2024-6353-04": {"ajax_action": "draw_wallet_transaction_details_table", "conditions": [{"name": "ARGS:start", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SELECT\\\\s.*FROM\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-6353", "description": "Wallet for WooCommerce <=1.5.4 authenticated SQL injection via start parameter in draw_wallet_transaction_details_table", "mode": "block", "severity": 8.8, "slug": "woo-wallet", "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2024-6353-05": {"ajax_action": "draw_wallet_transaction_details_table", "conditions": [{"name": "ARGS:length", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SELECT\\\\s.*FROM\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-6353", "description": "Wallet for WooCommerce <=1.5.4 authenticated SQL injection via length parameter in draw_wallet_transaction_details_table", "mode": "block", "severity": 8.8, "slug": "woo-wallet", "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2024-6365-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wootablepress"}, {"name": "ARGS:settings[order]", "type": "regex", "value": "~<\\\\?(?:php|=|\\\\s)|\\\\?>|<%|\\\\beval\\\\b|\\\\bassert\\\\b|\\\\bsystem\\\\b|\\\\bexec\\\\b|\\\\bpassthru\\\\b|\\\\bshell_exec\\\\b|\\\\bproc_open\\\\b|\\\\bpopen\\\\b|\\\\bbase64_decode\\\\b~i"}], "cve": "CVE-2024-6365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6365", "description": "Product Table by WBW <=2.0.1 unauthenticated RCE via PHP code injection in settings[order] written to customTitle.php", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woo-product-tables", "tags": ["remote-code-execution", "arbitrary-file-write", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2024-6365-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wootablepress"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\?(?:php|=|\\\\s)|\\\\?>|<%|\\\\beval\\\\b|\\\\bassert\\\\b|\\\\bsystem\\\\b|\\\\bexec\\\\b|\\\\bpassthru\\\\b|\\\\bshell_exec\\\\b|\\\\bproc_open\\\\b|\\\\bpopen\\\\b|\\\\bbase64_decode\\\\b~i"}], "cve": "CVE-2024-6365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6365", "description": "Product Table by WBW <=2.0.1 unauthenticated RCE via PHP code injection in settings phrase parameters written to customTitle.php", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woo-product-tables", "tags": ["remote-code-execution", "arbitrary-file-write", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2024-6366-02": {"ajax_action": "query-attachments", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-6366", "method": "POST", "mode": "block", "severity": 9.1, "slug": "profile-builder", "target": "plugin", "versions": "<=3.11.7"}, "RULE-CVE-2024-6451-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/options.php"}, {"name": "ARGS:logs_path", "type": "exists"}, {"name": "ARGS:logs_path", "type": "regex", "value": "~\\\\.(?:php|php[0-9]+|phtml)\\\\b~i"}], "cve": "CVE-2024-6451", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2024-6451-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/options.php"}, {"name": "ARGS:logs_path", "type": "exists"}, {"name": "ARGS:logs_path", "type": "regex", "value": "~^(?![^\\\\n]*\\\\.log$)[^\\\\n]+$~"}], "cve": "CVE-2024-6451", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2024-6455-01": {"ajax_action": "ekit_widgetarea_content", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-6455", "description": "ElementsKit Lite <=3.2.0 unauthenticated information exposure via ekit_widgetarea_content AJAX action exposing drafts, pending and private posts", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2024-6460-01": {"ajax_action": "tm_load_data", "conditions": [{"name": "ARGS:component", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^/|(?:php|data|expect|phar|zip)://)~i"}], "cve": "CVE-2024-6460", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6460", "description": "Grow by Tradedoubler <=2.0.21 unauthenticated Local File Inclusion via tm_load_data AJAX component parameter", "mode": "block", "severity": 9.8, "slug": "tradedoubler-affiliate-tracker", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.0.21"}, "RULE-CVE-2024-6500-01": {"action": "parse_request", "conditions": [{"name": "ARGS:easypack_download", "type": "regex", "value": "~(\\\\.\\\\.(?:[/\\\\\\\\]|%2f|%5c)|%2e(?:%2e|\\\\.(?:%2f|%5c|[/\\\\\\\\]))|%2e%2e(?:%2f|/|%5c|\\\\\\\\)|^/|^[A-Za-z]:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-6500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6500", "description": "InPost for WooCommerce <=1.4.4 unauthenticated arbitrary file read/delete via easypack_download query var", "mode": "block", "severity": 10.0, "slug": "inpost-for-woocommerce", "tags": ["missing-authorization", "path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2024-6522-01": {"ajax_action": "mec_fes_form", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"name": "ARGS:name", "type": "exists"}, {"name": "ARGS:value", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-6522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6522", "description": "Modern Events Calendar Lite <=7.12.1 authenticated (subscriber+) SSRF via mec_fes_form AJAX action", "method": "POST", "mode": "block", "severity": 9.6, "slug": "modern-events-calendar-lite", "tags": ["ssrf", "server-side-request-forgery", "authenticated", "cwe-918"], "target": "plugin", "versions": "<=7.12.1"}, "RULE-CVE-2024-6589-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "POST", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "POST", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "PATCH", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6624-01": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-01G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-02": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-02G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-03": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-03G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-04": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-04G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-05": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-05G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-06G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-07": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-07G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-08G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-09": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-09G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-10": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-10G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6660-01": {"ajax_action": "bookingpress_import_data_continue_process_func", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-6660", "description": "BookingPress <=1.1.5 missing authorization on bookingpress_import_data_continue_process_func allows subscriber+ arbitrary options update and file upload", "mode": "block", "severity": 8.8, "slug": "bookingpress-appointment-booking", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2024-6691-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php$~"}, {"name": "ARGS:option_page", "type": "equals", "value": "edd_settings"}], "cve": "CVE-2024-6691", "method": "POST", "mode": "block", "severity": 4.0, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-6692-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:edd_settings[agree_text]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-6692", "method": "POST", "mode": "block", "severity": 3.1, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-6704-01": {"ajax_action": "wpdAddComment", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via comment parameter in wpdAddComment AJAX handler", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6704-02": {"ajax_action": "wpdAddInlineComment", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via comment parameter in wpdAddInlineComment AJAX handler", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6704-03": {"ajax_action": "wpdGuestAction", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via guest comment submission", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6723-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[accessor]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.accessor in admin discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai-ui/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[accessor]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.accessor in public discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[by]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.by in admin discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai-ui/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[by]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.by in public discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6809-01": {"ajax_action": "qcsmd_upvote_action", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-6809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6809", "description": "Simple Video Directory <=1.4.2 unauthenticated SQL injection via id parameter in qcsmd_upvote_action AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "simple-media-directory", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-6849-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/async-upload\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (async-upload.php)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-6849-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/media-new\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (media-new.php)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-6849-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(?:]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (REST /wp/v2/media)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-7031-01": {"ajax_action": "njt_fs_save_setting_restrictions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7031", "method": "POST", "mode": "block", "severity": 8.8, "slug": "filester", "target": "plugin", "versions": "<=1.8.2"}, "RULE-CVE-2024-7031-02": {"ajax_action": "njt_fs_save_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7031", "method": "POST", "mode": "block", "severity": 8.8, "slug": "filester", "target": "plugin", "versions": "<=1.8.2"}, "RULE-CVE-2024-7094-01": {"action": "init", "conditions": [{"name": "ARGS:form_request", "type": "equals", "value": "jssupportticket"}, {"name": "ARGS:jstmod", "type": "equals", "value": "themes"}, {"name": "ARGS:task", "type": "equals", "value": "savetheme"}, {"name": "ARGS:/color[1-7]/", "type": "regex", "value": "~[\\"\'`;]|<\\\\?(?:php|=)|[$][a-zA-Z_]~"}], "cve": "CVE-2024-7094", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7094", "description": "JS Help Desk <=2.8.6 unauthorized frontend savetheme dispatch via formhandler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "js-support-ticket", "tags": ["missing-authorization", "code-injection", "frontend-form"], "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2024-7112-01": {"ajax_action": "dopbsp_calendar_schedule_set", "conditions": [{"name": "ARGS:schedule", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7112", "description": "Pinpoint Booking System <=2.9.9.5.0 authenticated SQL injection via schedule parameter in dopbsp_calendar_schedule_set AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-system", "target": "plugin", "versions": "<=2.9.9.5.0"}, "RULE-CVE-2024-7112-02": {"ajax_action": "dopbsp_calendar_schedule_get", "conditions": [{"name": "ARGS:schedule", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7112", "description": "Pinpoint Booking System <=2.9.9.5.0 authenticated SQL injection via schedule parameter in dopbsp_calendar_schedule_get AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-system", "target": "plugin", "versions": "<=2.9.9.5.0"}, "RULE-CVE-2024-7112-03": {"ajax_action": "dopbsp_calendar_schedule_set", "conditions": [{"name": "ARGS:calendar_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7112", "description": "Pinpoint Booking System <=2.9.9.5.0 authenticated SQL injection via calendar_id parameter in dopbsp_calendar_schedule_set AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-system", "target": "plugin", "versions": "<=2.9.9.5.0"}, "RULE-CVE-2024-7112-04": {"ajax_action": "dopbsp_calendar_schedule_get", "conditions": [{"name": "ARGS:calendar_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7112", "description": "Pinpoint Booking System <=2.9.9.5.0 authenticated SQL injection via calendar_id parameter in dopbsp_calendar_schedule_get AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-system", "target": "plugin", "versions": "<=2.9.9.5.0"}, "RULE-CVE-2024-7122-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:separator_title|button_text(?:_2)?|image_[12]_label|alt_text)[^}]*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-7122", "description": "Addon Elements for Elementor <=1.13.6 contributor+ stored XSS via unescaped widget attributes in Elementor AJAX save", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "target": "plugin", "versions": "<=1.13.6"}, "RULE-CVE-2024-7122-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:separator_title|button_text(?:_2)?|image_[12]_label|alt_text)[^}]*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-7122", "description": "Addon Elements for Elementor <=1.13.6 contributor+ stored XSS via unescaped widget attributes in Elementor REST save", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "target": "plugin", "versions": "<=1.13.6"}, "RULE-CVE-2024-7257-01": {"ajax_action": "yaye_handle_upload_file", "conditions": [{"name": "FILES:option_field_data", "type": "exists"}], "cve": "CVE-2024-7257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7257", "description": "YayExtra \\u2013 WooCommerce Extra Product Options <=1.3.7 unauthenticated arbitrary file upload via yaye_handle_upload_file AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "yayextra", "tags": ["arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2024-7258-01": {"ajax_action": "myajax-delete-feed-file", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:feed_id", "type": "exists"}], "cve": "CVE-2024-7258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7258", "description": "WP Product Feed Manager <=2.8.0 unauthenticated feed file deletion via missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-product-feed-manager", "tags": ["missing-authorization", "idor"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-7258-02": {"ajax_action": "myajax-delete-feed", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:feed_id", "type": "exists"}], "cve": "CVE-2024-7258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7258", "description": "WP Product Feed Manager <=2.8.0 unauthenticated feed deletion via missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-product-feed-manager", "tags": ["missing-authorization", "idor"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-7302-01": {"ajax_action": "b2s_upload_video", "conditions": [{"name": "ARGS:post_title", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouse(?:down|up|over|out|move)|key(?:down|up|press)|focus|blur|change|submit|reset|select|abort|dragstart|drag|dragend|drop)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-7302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7302", "description": "Blog2Social <=7.5.4 stored XSS via post_title in video upload", "method": "POST", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=7.5.4"}, "RULE-CVE-2024-7315-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-content/wpvividbackups/[^/]+\\\\.(?:zip|sql|gz|tar|json|txt|log)(?:\\\\?|$)~i"}], "cve": "CVE-2024-7315", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<0.9.106"}, "RULE-CVE-2024-7315-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-content/wpvividbackups/wpvivid_log/~i"}], "cve": "CVE-2024-7315", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<0.9.106"}, "RULE-CVE-2024-7385-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wshs_saved"}, {"name": "ARGS:action", "type": "equals", "value": "delete"}, {"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-7385", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7385", "description": "WordPress Simple HTML Sitemap <=3.1 authenticated (Admin+) SQL injection via id parameter in wshs_saved delete action", "mode": "block", "severity": 7.2, "slug": "wp-simple-html-sitemap", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2024-7385-02": {"ajax_action": "wshs_save_shortcode", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-7385", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7385", "description": "WordPress Simple HTML Sitemap <=3.1 SQL injection via id parameter in wshs_save_shortcode AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-simple-html-sitemap", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2024-7493-01": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:role", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via role parameter in registration", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7493-02": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:meta_input[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via meta_input wp_capabilities", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7493-03": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:meta_input[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via meta_input wp_user_level", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7514-01": {"ajax_action": "product_comments_csv_import_request", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2[Ee]){2}%2[Ff]|(?:%252[Ee]){2}%25(?:2[Ff]|5[Cc])|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}, {"type": "missing_capability", "value": "import"}], "cve": "CVE-2024-7514", "description": "Comments Import & Export <=2.3.7 authenticated arbitrary file read via path traversal in file parameter", "mode": "block", "severity": 6.5, "slug": "comments-import-export-woocommerce", "target": "plugin", "versions": "<=2.3.7"}, "RULE-CVE-2024-7548-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "PATCH", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7590-01": {"ajax_action": "uag_load_image_gallery_masonry", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-7590", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.15.0"}, "RULE-CVE-2024-7590-02": {"ajax_action": "uag_load_image_gallery_grid_pagination", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-7590", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.15.0"}, "RULE-CVE-2024-7607-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "feup-users"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7607", "description": "Front End Only Users <=3.2.28 authenticated SQL injection via order parameter on feup-users admin page", "mode": "block", "severity": 8.8, "slug": "front-end-only-users", "target": "plugin", "versions": "<=3.2.28"}, "RULE-CVE-2024-7656-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~devvn_ihotspot[\\\\s\\\\S]{0,2000}?[OC]:[0-9]+:(?:\\\\\\\\?\\"|"|%22)~i"}], "cve": "CVE-2024-7656", "description": "Image Hotspot by DevVN <=1.2.5 authenticated (Author+) PHP Object Injection via devvn_ihotspot shortcode unserialize sink \\u2014 write-time block on content param", "mode": "block", "severity": 8.8, "slug": "devvn-image-hotspot", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-7656-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~devvn_ihotspot[\\\\s\\\\S]{0,2000}?[OC]:[0-9]+:(?:\\\\\\\\?\\"|"|%22)~i"}], "cve": "CVE-2024-7656", "description": "Image Hotspot by DevVN <=1.2.5 authenticated (Author+) PHP Object Injection via post_content carrying devvn_ihotspot serialized object", "mode": "block", "severity": 8.8, "slug": "devvn-image-hotspot", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-7703-01": {"ajax_action": "arm_upload_front", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_front", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-02": {"ajax_action": "arm_upload_cover", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_cover", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-03": {"ajax_action": "arm_upload_profile", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_profile", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-04": {"ajax_action": "arm_import_user", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file import in arm_import_user", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7717-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/edit.php"}, {"name": "ARGS:post_type", "type": "equals", "value": "tp_event"}, {"name": "ARGS:orderby", "type": "exists"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|\\\\bOR\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2024-7717", "description": "WP Events Manager <=2.1.11 authenticated SQL injection via order parameter in admin event list sorting", "mode": "block", "severity": 8.8, "slug": "wp-events-manager", "target": "plugin", "versions": "<=2.1.11"}, "RULE-CVE-2024-7770-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~file-manager/libs/elFinder/php/connector~i"}, {"name": "FILES:upload:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$~i"}], "cve": "CVE-2024-7770", "description": "Bit File Manager <=6.5.5 block direct access to elFinder connector with dangerous file upload", "mode": "block", "severity": 8.8, "slug": "file-manager", "target": "plugin", "versions": "<=6.5.5"}, "RULE-CVE-2024-7856-01": {"ajax_action": "removeTempFiles", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7856", "description": "MP3 Music Player by Sonaar <=5.7.0.1 missing authorization (subscriber+) arbitrary file deletion via removeTempFiles AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mp3-music-player-by-sonaar", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=5.7.0.1"}, "RULE-CVE-2024-7857-01": {"ajax_action": "mlf_change_sort_type", "conditions": [{"name": "ARGS:sort_type", "type": "detectSQLi"}], "cve": "CVE-2024-7857", "method": "POST", "mode": "block", "severity": 6.5, "slug": "media-library-plus", "target": "plugin", "versions": "<=8.2.2"}, "RULE-CVE-2024-7982-01": {"ajax_action": "rtec_process_form_submission", "conditions": [{"name": "ARGS:first_name", "type": "detectXSS"}], "cve": "CVE-2024-7982", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7982", "description": "Registrations for the Events Calendar <=2.12.3 unauthenticated stored XSS via first_name in registration form submission", "method": "POST", "mode": "block", "severity": 9.6, "slug": "registrations-for-the-events-calendar", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2024-7982-02": {"ajax_action": "rtec_process_form_submission", "conditions": [{"name": "ARGS:last_name", "type": "detectXSS"}], "cve": "CVE-2024-7982", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7982", "description": "Registrations for the Events Calendar <=2.12.3 unauthenticated stored XSS via last_name in registration form submission", "method": "POST", "mode": "block", "severity": 9.6, "slug": "registrations-for-the-events-calendar", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2024-7985-01": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "upload"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|phtml|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess)$~i"}], "cve": "CVE-2024-7985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7985", "description": "File Organizer <=1.0.9 authenticated arbitrary file upload via filename extension bypass", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["arbitrary-file-upload", "authenticated", "file-upload"], "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2024-8252-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[clean-login-register[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*\\\\.\\\\.[/\\\\\\\\]~i"}], "cve": "CVE-2024-8252", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8252", "description": "Clean Login <=1.14.5 authenticated (Contributor+) local file inclusion via clean-login-register shortcode template attribute in post content (post.php)", "mode": "block", "severity": 8.8, "slug": "clean-login", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.14.5"}, "RULE-CVE-2024-8252-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[clean-login-register[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*\\\\.\\\\.[/\\\\\\\\]~i"}], "cve": "CVE-2024-8252", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8252", "description": "Clean Login <=1.14.5 authenticated (Contributor+) local file inclusion via clean-login-register shortcode template attribute in REST API post creation", "mode": "block", "severity": 8.8, "slug": "clean-login", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.14.5"}, "RULE-CVE-2024-8271-01": {"ajax_action": "woocs_get_custom_price_html", "conditions": [{"name": "ARGS:custom_prices", "type": "regex", "value": "~(?:\\\\[[a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|\\\\]|/)|%5[Bb][a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|%5[Dd]|/)|%25[57]5[Bb][a-zA-Z])~"}], "cve": "CVE-2024-8271", "description": "WooCommerce Currency Switcher <=1.4.2.1 unauthenticated arbitrary shortcode execution via woocs_get_custom_price_html AJAX action (custom_prices parameter flows to do_shortcode at classes/woocs.php:4600)", "mode": "block", "severity": 7.3, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.2.1"}, "RULE-CVE-2024-8271-02": {"ajax_action": "nopriv_woocs_get_custom_price_html", "conditions": [{"name": "ARGS:custom_prices", "type": "regex", "value": "~(?:\\\\[[a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|\\\\]|/)|%5[Bb][a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|%5[Dd]|/)|%25[57]5[Bb][a-zA-Z])~"}], "cve": "CVE-2024-8271", "description": "WooCommerce Currency Switcher <=1.4.2.1 unauthenticated arbitrary shortcode execution via woocs_get_custom_price_html AJAX action (nopriv hook)", "mode": "block", "severity": 7.3, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.2.1"}, "RULE-CVE-2024-8275-01": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|EXTRACTVALUE\\\\s*\\\\(|CONCAT\\\\s*\\\\(|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-8275", "description": "The Events Calendar <=6.6.4 unauthenticated SQL injection via order parameter in tribe_has_next_event template tag", "method": "GET", "mode": "block", "severity": 9.8, "slug": "the-events-calendar", "target": "plugin", "versions": "<=6.6.4"}, "RULE-CVE-2024-8289-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/?(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "PUT", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "PATCH", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "delete_users"}], "cve": "CVE-2024-8289", "method": "DELETE", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/batch(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8353-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address_2", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-04": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_city", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-05": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_state", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-06": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_zip", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-07": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_name", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-08": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_number", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-09": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_cvc", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-10": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_exp_month", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-11": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_exp_year", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-12": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:billing_country", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-13": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_first", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-14": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_last", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-15": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-form-title", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8485-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/watch-life-net/v1/weixin/updateuserinfo(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2024-8485", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8485", "description": "REST API TO MiniProgram <=4.7.1 unauthenticated arbitrary user email update and privilege escalation via updateuserinfo REST endpoint IDOR", "method": "POST", "mode": "block", "severity": 9.8, "slug": "rest-api-to-miniprogram", "tags": ["authorization-bypass", "idor", "privilege-escalation", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.7.6"}, "RULE-CVE-2024-8500-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]*on|<\\\\s*img[^>]+onerror|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-8500", "description": "Shortcodes Ultimate <=7.2.2 Contributor+ XSS via su_generator_preview shortcode/atts/content parameters reaching echo sink in Su_Generator::preview", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.2.2"}, "RULE-CVE-2024-8500-02": {"ajax_action": "su_generator_settings", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]*on|<\\\\s*img[^>]+onerror)~i"}], "cve": "CVE-2024-8500", "description": "Shortcodes Ultimate <=7.2.2 Contributor+ XSS/code-flow via su_generator_settings shortcode parameter reaching echo/call_user_func sinks", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.2.2"}, "RULE-CVE-2024-8519-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "um_loggedin"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|toggle|begin|end)\\\\s*=|javascript\\\\s*:|<\\\\s*iframe[\\\\s>]|<\\\\s*svg[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-8519", "description": "Ultimate Member <=2.8.6 stored XSS via um_loggedin shortcode lock_text attribute or inner content", "mode": "block", "severity": 6.4, "slug": "ultimate-member", "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2024-8522-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/learnpress/v1/courses~"}, {"name": "ARGS:c_only_fields", "type": "regex", "value": "~(?i)(SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\(SELECT\\\\b|UNION\\\\s+SELECT\\\\b)~"}], "cve": "CVE-2024-8522", "description": "LearnPress <=4.2.7 unauthenticated SQL injection via c_only_fields parameter in REST courses endpoint.", "method": "GET", "mode": "block", "severity": 7.5, "slug": "learnpress", "target": "plugin", "versions": "<4.2.7.1"}, "RULE-CVE-2024-8529-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/lp/v1/courses/archive-course(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:c_fields", "type": "detectSQLi"}], "cve": "CVE-2024-8529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8529", "description": "LearnPress <= 4.2.7 unauthenticated SQL injection via c_fields parameter on the REST endpoint /wp-json/lp/v1/courses/archive-course. The REQUEST_URI regex is intentionally used alongside action: rest_api_init to tightly scope detection to only the known vulnerable REST route, avoiding false positives on other LearnPress REST endpoints that do not consume c_fields/c_only_fields.", "mode": "block", "severity": 9.8, "slug": "learnpress-wordpress-lms-plugin", "tags": ["sqli", "unauthenticated", "rest-api", "learnpress"], "target": "plugin", "versions": "<=4.2.7"}, "RULE-CVE-2024-8529-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/lp/v1/courses/archive-course(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:c_only_fields", "type": "detectSQLi"}], "cve": "CVE-2024-8529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8529", "description": "LearnPress <= 4.2.7 unauthenticated SQL injection via c_only_fields parameter on the REST endpoint /wp-json/lp/v1/courses/archive-course. The REQUEST_URI regex is intentionally used alongside action: rest_api_init to tightly scope detection to only the known vulnerable REST route, avoiding false positives on other LearnPress REST endpoints that do not consume c_fields/c_only_fields.", "mode": "block", "severity": 9.8, "slug": "learnpress-wordpress-lms-plugin", "tags": ["sqli", "unauthenticated", "rest-api", "learnpress"], "target": "plugin", "versions": "<=4.2.7"}, "RULE-CVE-2024-8549-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:edit\\\\.php|post\\\\.php|post-new\\\\.php|admin\\\\.php|options-general\\\\.php).*[?&].*(?:post_type=calendar|page=simple-calendar)~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:%3[Cc]|<)(?:[a-zA-Z/!]|%2[Ff])|(?:%22|%27|\\"|\')\\\\s*(?:%3[Ee]|>)|javascript(?:%3[Aa]|:)|on(?:load|error|click|focus|mouseover|mouseenter|toggle|animationstart|animationend|pointerdown|pointerover|wheel|keydown|keyup|blur|change|submit|input)\\\\s*(?:%3[Dd]|=)|(?:%3[Cc]|<)(?:script|svg|img|iframe|body|input|object|embed|link|style|meta|video|audio|details|marquee)~i"}], "cve": "CVE-2024-8549", "description": "Simple Calendar (google-calendar-events) <=3.4.2 reflected XSS via admin_notices add_query_arg URL reflected from REQUEST_URI without esc_url", "mode": "block", "severity": 6.1, "slug": "google-calendar-events", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2024-8672-01": {"ajax_action": "widgetopts_migrator", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-8672", "description": "Widget Options <=4.0.7 widgetopts_migrator AJAX handler lacks nonce and capability checks, allowing authenticated users to trigger file delete/upload/include operations via the import-export migrator flow", "mode": "block", "severity": 9.9, "slug": "widget-options", "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2024-8800-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "rabbit-loader"}, {"name": "ARGS", "type": "regex", "value": "~(?i)(%3Cscript|]*onerror\\\\s*=|<[^>]*onload\\\\s*=|<[^>]*onclick\\\\s*=|\\\\bonerror\\\\s*=|\\\\bonload\\\\s*=|\\\\bonclick\\\\s*=|%22%3E|%27%3E)~"}], "cve": "CVE-2024-8800", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.21.0"}, "RULE-CVE-2024-8800-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "rabbit-loader"}, {"name": "ARGS", "type": "regex", "value": "~(?i)%3cscript|]*onerror\\\\s*=|]*href\\\\s*=\\\\s*[\'\\"]javascript:~"}], "cve": "CVE-2024-8800", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.21.0"}, "RULE-CVE-2024-8853-01": {"action": "wp_loaded", "conditions": [{"name": "ARGS:user_login", "type": "contains", "value": "-wfuser"}], "cve": "CVE-2024-8853", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8853", "description": "Webo-facto <=1.40 unauthenticated privilege escalation via user_login containing -wfuser substring", "method": "POST", "mode": "block", "severity": 9.8, "slug": "webo-facto-connector", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=1.40"}, "RULE-CVE-2024-8978-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(\\\\{\\\\{password\\\\}\\\\}|%7B%7Bpassword%7D%7D)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-8978", "method": "POST", "mode": "block", "severity": 5.7, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.9"}, "RULE-CVE-2024-8979-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:elementor_ajax|eael_get_token|save_settings_with_ajax|save_eael_elements_data)$~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\[user_password\\\\]~i"}], "cve": "CVE-2024-8979", "description": "Essential Addons for Elementor Lite <=6.0.9 sensitive information disclosure via [user_password] placeholder in lostpassword email template (Login_Register widget)", "mode": "block", "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.9"}, "RULE-CVE-2024-8981-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^blc_(?:dash|local)$~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3[Cc]script[\\\\s%]|%22\\\\s*on\\\\w+\\\\s*%3[Dd])~i"}], "cve": "CVE-2024-8981", "description": "Broken Link Checker <=2.4.0 reflected XSS via unsanitized add_query_arg on admin notice page (blc_dash/blc_local)", "mode": "block", "severity": 7.1, "slug": "broken-link-checker", "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2024-9018-01": {"ajax_action": "wpeg_shortcode", "conditions": [{"name": "ARGS:key", "type": "exists"}, {"name": "ARGS:key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|(?:\'|%27)\\\\s*(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:\'|%27)\\\\s*(?:AND|OR)\\\\s+.*(?:SLEEP|BENCHMARK)|--\\\\s|/\\\\*[!+]|#\\\\s)~i"}], "cve": "CVE-2024-9018", "description": "WP Easy Gallery <=4.8.5 authenticated SQL injection via key parameter in wpeg_shortcode AJAX handler", "mode": "block", "severity": 8.8, "slug": "wp-easy-gallery", "target": "plugin", "versions": "<=4.8.5"}, "RULE-CVE-2024-9047-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wfu_file_downloader\\\\.php~i"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|\\\\.\\\\.%2f|\\\\.\\\\.%5c|%2e%2e(?:%2f|%5c)|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2024-9047", "description": "WordPress File Upload (wp-file-upload) <=4.24.11 unauthenticated path traversal via file parameter in wfu_file_downloader.php allowing arbitrary file read/delete", "mode": "block", "severity": 9.8, "slug": "wp-file-upload", "target": "plugin", "versions": "<=4.24.11"}, "RULE-CVE-2024-9061-01": {"ajax_action": "shortcode_Api_Add", "conditions": [{"name": "ARGS:custom-popup", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9061", "description": "WP Popup Builder <=1.3.5 unauthenticated arbitrary shortcode execution via custom-popup parameter", "mode": "block", "severity": 9.8, "slug": "wp-popup-builder", "target": "plugin", "versions": "<=1.3.5"}, "RULE-CVE-2024-9263-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/timetics/v1/customers(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9263", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9263", "description": "WP Timetics <=1.0.25 unauthenticated account takeover via IDOR on REST customers endpoint", "method": "POST", "mode": "block", "severity": 9.8, "slug": "timetics", "tags": ["idor", "account-takeover", "unauthenticated", "rest-api", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.25"}, "RULE-CVE-2024-9390-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9390-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9390-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9416-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "modula-gallery"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9416", "description": "Modula Image Gallery <=2.10.1 contributor+ stored XSS via FancyBox attributes in gallery CPT settings", "mode": "block", "severity": 6.4, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.10.1"}, "RULE-CVE-2024-9416-02": {"ajax_action": "add_images_to_gallery", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9416", "description": "Modula Image Gallery <=2.10.1 contributor+ stored XSS via add_images_to_gallery AJAX handler", "mode": "block", "severity": 6.4, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.10.1"}, "RULE-CVE-2024-9501-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wslu-social-login/type/[^/]+(/|\\\\?|$)~"}, {"name": "ARGS:code", "type": "regex", "value": "~.+~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9501", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9501", "description": "Wp Social Login and Register Social Counter <=3.0.7 authentication bypass via social login OAuth callback REST route", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wp-social", "tags": ["authentication-bypass", "unauthenticated", "rest-api", "oauth"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2024-9504-01": {"ajax_action": "wpdevart_form_ajax", "conditions": [{"name": "FILES:file0", "type": "exists"}], "cve": "CVE-2024-9504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9504", "description": "Booking Calendar <=3.2.15 unauthenticated stored XSS via SVG file upload in wpdevart_form_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "booking-calendar", "tags": ["xss", "svg-upload", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2024-9598-01": {"ajax_action": "redux_p", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9598", "description": "AMP for WP CSRF via missing nonce validation on redux_p AJAX proxy endpoint", "mode": "block", "severity": 8.8, "slug": "accelerated-mobile-pages", "target": "plugin", "versions": "<=1.0.99.1"}, "RULE-CVE-2024-9634-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_company_name", "type": "regex", "value": "~(^\\\\s*|[;{]\\\\s*)O:\\\\d+:\\"~"}], "cve": "CVE-2024-9634", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.16.3"}, "RULE-CVE-2024-9634-02": {"action": "init", "conditions": [{"name": "ARGS:give_action", "type": "equals", "value": "purchase"}, {"name": "ARGS:give_company_name", "type": "regex", "value": "~(^\\\\s*|[;{]\\\\s*)O:\\\\d+:\\"~"}], "cve": "CVE-2024-9634", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.16.3"}, "RULE-CVE-2024-9636-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid/v2/process_form_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_meta[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-9636", "method": "POST", "mode": "block", "severity": 9.8, "slug": "post-grid", "target": "plugin", "versions": ">=2.2.85 <=2.3.3"}, "RULE-CVE-2024-9636-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid/v2/process_form_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_meta[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-9636", "method": "POST", "mode": "block", "severity": 9.8, "slug": "post-grid", "target": "plugin", "versions": ">=2.2.85 <=2.3.3"}, "RULE-CVE-2024-9655-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v[12]/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/(?:single-)?icon[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9655", "description": "Kadence Blocks <=3.3.1 authenticated (Contributor+) stored XSS via Icon Widget block attributes in REST API post save", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-9655-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/(?:single-)?icon[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9655", "description": "Kadence Blocks <=3.3.1 authenticated (Contributor+) stored XSS via Icon Widget block attributes in classic editor post save", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-9669-01": {"ajax_action": "njt_fs_save_setting", "conditions": [{"name": "ARGS:fm_locale", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]\\\\.\\\\.|%2e%2e[%2f%5c]|%252e%252e|%00)~i"}], "cve": "CVE-2024-9669", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9669", "description": "Filester <=1.8.5 local file inclusion via fm_locale path traversal in njt_fs_save_setting", "method": "POST", "mode": "block", "severity": 7.2, "slug": "filester", "tags": ["local-file-inclusion", "path-traversal"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2024-9707-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ai/v1/ai-site-import(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9707", "method": "POST", "mode": "block", "severity": 9.8, "slug": "hunk-companion", "target": "plugin", "versions": "<=1.8.4"}, "RULE-CVE-2024-9769-01": {"ajax_action": "tsvg_check_attachment", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9769", "method": "POST", "mode": "block", "severity": 4.4, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2024-9769-02": {"ajax_action": "tsvg_get_attachment_id", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9769", "method": "POST", "mode": "block", "severity": 4.4, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2024-9881-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "learn-press-settings"}, {"name": "ARGS:learn_press_offline_payment[description]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9881", "method": "POST", "mode": "block", "severity": 4.8, "slug": "learnpress", "target": "plugin", "versions": "<4.2.7.2"}, "RULE-CVE-2024-9933-01": {"action": "parse_request", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wht_login/?(?:$|\\\\?|/(?:$|\\\\?))~"}], "cve": "CVE-2024-9933", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9933", "description": "WatchTowerHQ <=3.10.1 unauthenticated authentication bypass via empty access_token on /wht_login/ rewrite rule path", "method": "GET", "mode": "block", "severity": 9.8, "slug": "watchtowerhq", "tags": ["authentication-bypass", "unauthenticated", "missing-empty-value-check"], "target": "plugin", "versions": "<=3.10.1"}, "RULE-CVE-2024-9933-02": {"action": "parse_request", "conditions": [{"name": "ARGS:wht_login", "type": "exists"}, {"name": "ARGS:access_token", "type": "regex", "value": "~^.{0,35}$~"}], "cve": "CVE-2024-9933", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9933", "description": "WatchTowerHQ <=3.10.1 unauthenticated authentication bypass via invalid-length access_token query var", "method": "GET", "mode": "block", "severity": 9.8, "slug": "watchtowerhq", "tags": ["authentication-bypass", "unauthenticated", "missing-empty-value-check"], "target": "plugin", "versions": "<=3.10.1"}, "RULE-CVE-2024-9935-01": {"action": "init", "conditions": [{"name": "ARGS:rtw_pdf_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2024-9935", "description": "PDF Generator Addon for Elementor Page Builder <=2.0.0 local file inclusion via rtw_pdf_file parameter", "mode": "block", "severity": 7.5, "slug": "pdf-generator-addon-for-elementor-page-builder", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2024-9993-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "contains", "value": "eael_event_details_text"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur|input|change|keyup|keydown|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-9993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9993", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_event_details_text in Event Calendar widget", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2024-9993-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "contains", "value": "eael_pricing_item_tooltip_content"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur|input|change|keyup|keydown|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-9993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9993", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_pricing_item_tooltip_content in Pricing Table widget", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2024-9994-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "eael_pricing_item_tooltip_content"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<(?:script|img|svg|iframe|details|video|audio|source)[\\\\s/>]|on(?:error|load|toggle|click|mouse\\\\w+|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9994", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_pricing_item_tooltip_content in Pricing Table widget", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2025-0215-01": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:uri", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via uri parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0215-02": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:initiate_restore", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via initiate_restore parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0215-03": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:showdata", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via showdata parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0308-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT\\\\b|;(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|EXEC)\\\\b|(?:[\'\\"]|\\\\d)(?:[\\\\s)]|/\\\\*[^*]*\\\\*/)*\\\\b(?:OR|AND|XOR)\\\\b(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)*(?:\\\\(*\\\\s*[\'\\"]?[\\\\w.]+[\'\\"]?\\\\s*(?:=|<>|!=|<=|>=|<|>)|\\\\(*\\\\s*(?:SELECT|SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|IF|CASE|EXISTS|ELT|MAKE_SET|LOAD_FILE|GROUP_CONCAT|CONCAT|ASCII|SUBSTRING|SUBSTR|MID|ORD)(?:/\\\\*[^*]*\\\\*/)*\\\\(|(?:TRUE|FALSE|NULL)\\\\b\\\\s*(?:$|[-#;)]|/\\\\*)|\\\\bLIKE\\\\s*[\'\\"]?%)|\\\\(\\\\s*(?:/\\\\*[^*]*\\\\*/\\\\s*)?SELECT\\\\b[\\\\s(].{0,64}?\\\\bFROM\\\\b|\\\\b(?:RLIKE|REGEXP)\\\\s*\\\\(|\\\\binformation_schema\\\\b|\\\\bPROCEDURE\\\\s+ANALYSE\\\\b|[\'\\"`;(),=|&+\\\\~!<>@].{0,64}?\\\\b(?:SL(?:/\\\\*[^*]*\\\\*/)*EEP|BENCHMARK)(?:/\\\\*[^*]*\\\\*/)*\\\\(|\\\\b(?:EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|[\'\\"]\\\\s*(?:--(?:\\\\s|$)|#|/\\\\*))~is"}], "cve": "CVE-2025-0308", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0308", "description": "Ultimate Member <=2.9.1 unauthenticated SQL injection via search parameter in um_get_members AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ultimate-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=2.9.1"}, "RULE-CVE-2025-0311-01": {"action": "admin_init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~button_link[^}]*url[^}]*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget button_link URL (javascript:/data: URI injection)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-02": {"action": "admin_init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:title_tag|subtitle_tag)[^}]*(?:script|img|svg|iframe|body|object|embed|form|input|select|textarea|details|marquee|video|audio|math|base|link|meta|style|applet|isindex|frame|frameset|bgsound|keygen|source|layer|ilayer|blink|plaintext|listing|xmp|noembed|noscript|xml|xss)~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget title_tag/subtitle_tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~button_link[^}]*url[^}]*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget button_link URL through REST API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~(?:title_tag|subtitle_tag)[^}]*(?:script|img|svg|iframe|body|object|embed|form|input|select|textarea|details|marquee|video|audio|math|base|link|meta|style|applet|isindex|frame|frameset|bgsound|keygen|source|layer|ilayer|blink|plaintext|listing|xmp|noembed|noscript|xml|xss)~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget title_tag/subtitle_tag through REST API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0329-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpbot"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via admin settings page (event handler injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpbot"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe)[^>]*>~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via admin settings page (script/iframe tag injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-03": {"ajax_action": "openai_settings_option", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via openai_settings_option AJAX (event handler injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-04": {"ajax_action": "openai_settings_option", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe)[^>]*>~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via openai_settings_option AJAX (script/iframe tag injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0350-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wdcl_image_carousel_child\\\\b[^\\\\]]*(?:][^\\"\\\\\\\\]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0506", "description": "Rise Blocks <=3.6 Stored XSS via titleTag block attribute in site-identity block (REST API post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.6"}, "RULE-CVE-2025-0506-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "rise-blocks/site-identity"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"(?:titleTag|taglineTag)\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]*[<>][^\\"\\\\\\\\]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0506", "description": "Rise Blocks <=3.6 Stored XSS via titleTag block attribute in site-identity block (classic post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.6"}, "RULE-CVE-2025-0507-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:ticketmeo|ploxel|ticketix)\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|on(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|�*60;)\\\\s*(?:script|iframe|svg|img))[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0512", "description": "Structured Content (JSON-LD) <=1.6.3 Stored XSS via sc_fs_local_business shortcode description attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "structured-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2025-0512-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sc_fs_local_business\\\\s[^\\\\]]*(?:]*\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|�*60;)\\\\s*(?:script|iframe|svg|img))[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0512", "description": "Structured Content (JSON-LD) <=1.6.3 Stored XSS via sc_fs_local_business shortcode description attribute (Classic Editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "structured-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2025-0682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-json/trx_addons/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/])+|(?:php|data|expect|phar|zip|compress\\\\.zlib|file)://~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 path traversal and PHP wrapper abuse in REST API. Blocks directory traversal (../../) and PHP stream wrappers (php://, phar://, etc.) in any parameter sent to /wp-json/trx_addons/ endpoints. Covers CVE-2020-10257 RCE vector and CVE-2025-0682 shortcode LFI when accessed via REST.", "mode": "block", "severity": 8.8, "slug": "trx_addons", "tags": ["lfi", "path-traversal", "rest-api", "generic", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0682-02": {"action": "init", "conditions": [{"name": "ARGS:/^(type|layout|template|view|skin)$/", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}(?!(?:fonts|images|css|js|assets|vendor|dist|lib|node_modules|wp-content|wp-includes|uploads|components|templates|shortcodes)[\\\\/])|(?:php|phar|expect|zip|compress\\\\.zlib|data|file)://~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 path traversal in template selector parameters (type, layout, template, view, skin) across all entry points \\u2014 AJAX, shortcodes, REST, front-end template loaders. Fires on init hook for maximum coverage. Covers 190+ theme-level LFI CVEs from AncoraThemes, axiomthemes, ThemeREX.", "mode": "block", "severity": 8.1, "slug": "trx_addons", "tags": ["lfi", "path-traversal", "shortcode", "ajax", "generic", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0682-03": {"action": "init", "conditions": [{"name": "ARGS:/^(type|layout|template|view|skin)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log|(?:id_[rd]sa|authorized_keys))~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 defense-in-depth: block known sensitive file names in template selector parameters. Catches absolute path inclusion attempts without directory traversal (e.g., type=wp-config.php).", "mode": "block", "severity": 8.1, "slug": "trx_addons", "tags": ["lfi", "sensitive-file", "defense-in-depth", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0764-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] in profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~^\\\\s*(?:file|phar|php|zip|data|expect|glob)://~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] local scheme in profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "local-file-inclusion", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|/proc/self/)~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via absolute path in data[avatar] profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-07": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] path traversal in frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-08": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~^\\\\s*(?:file|phar|php|zip|data|expect|glob)://~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] local scheme in frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "local-file-inclusion", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-09": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|/proc/self/)~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via absolute path in data[avatar] frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0804-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^clickwhale~"}, {"name": "ARGS:title", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0804", "description": "ClickWhale <=2.4.1 Stored XSS via link title on admin page", "method": "POST", "mode": "block", "severity": 5.4, "slug": "clickwhale", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0805-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mlcalc\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0863", "description": "Flexmls IDX <=3.14.28 Stored XSS via idx_frame shortcode attributes in classic post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flexmls-idx", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.28"}, "RULE-CVE-2025-0863-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[idx_frame\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0863", "description": "Flexmls IDX <=3.14.28 Stored XSS via idx_frame shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flexmls-idx", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.28"}, "RULE-CVE-2025-0897-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1)[\\\\s\\\\S])*?\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr parameter (post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*[\'\\"][^\'\\"]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr with javascript URI (post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:expression|vbscript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr with data URI (post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1)[\\\\s\\\\S])*?\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr parameter (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:javascript\\\\s*:|expression|vbscript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr with javascript/data URI (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0912-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[country]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[address1]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[address2]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-04": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[city]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-05": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[state]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-06": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[zip]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-07": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:firstName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-08": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:lastName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-09": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[country]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-10": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[address1]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-11": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[address2]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-12": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[city]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-13": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[state]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-14": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[zip]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-15": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:firstName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-16": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:lastName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0916-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:<(?:script|iframe|svg|object|embed|form)[\\\\s/>]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0916", "description": "YaySMTP <=2.6.3 stored XSS via comment body logged as email content without sanitization", "method": "POST", "mode": "block", "severity": 6.1, "slug": "yaysmtp", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": ">=2.4.9 <=2.6.3"}, "RULE-CVE-2025-0916-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:<(?:script|iframe|svg|object|embed|form)[\\\\s/>]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0916", "description": "YaySMTP <=2.6.3 stored XSS via comment author name logged as email content without sanitization", "method": "POST", "mode": "block", "severity": 6.1, "slug": "yaysmtp", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": ">=2.4.9 <=2.6.3"}, "RULE-CVE-2025-0918-01": {"ajax_action": "_email_logs", "conditions": [{"name": "ARGS:params[valSearch]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|object|embed|body|input|details|video|audio|a)\\\\b|on[a-z]+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-0918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0918", "description": "SMTP for SendGrid - YaySMTP <=1.4 stored XSS via email log list (action=_email_logs); blocks HTML/script payload in params[valSearch]", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendgrid", "tags": ["xss", "stored-xss", "email-log"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-0918-02": {"ajax_action": "_detail_email_logs", "conditions": [{"name": "ARGS:params[id]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|object|embed|body|input|details|video|audio|a)\\\\b|on[a-z]+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-0918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0918", "description": "SMTP for SendGrid - YaySMTP <=1.4 stored XSS via email log detail (action=_detail_email_logs); blocks HTML/script payload in params[id]", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendgrid", "tags": ["xss", "stored-xss", "email-log"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-0924-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:log", "type": "detectXSS"}], "cve": "CVE-2025-0924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0924", "description": "WP Activity Log <=5.2.2 unauthenticated stored XSS via username field on login form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-security-audit-log", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2025-0953-01": {"ajax_action": "_detail_email_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0953", "description": "SMTP for Sendinblue YaySMTP <=1.2 unauthenticated stored XSS via email log detail", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendinblue", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-0953-02": {"ajax_action": "_email_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0953", "description": "SMTP for Sendinblue YaySMTP <=1.2 unauthenticated stored XSS via email log list", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendinblue", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-0957-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^yay_smtp_amazonses_email_logs$~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-0957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0957", "description": "SMTP for Amazon SES <= 1.8 stored XSS via admin email logs list AJAX - attacker-controlled email content may be rendered in logs; block XSS markers in search parameter (s)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-0957-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^yay_smtp_amazonses_detail_email_logs$~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-0957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0957", "description": "SMTP for Amazon SES <= 1.8 stored XSS via admin email log detail AJAX - attacker-controlled email content may be rendered in log detail; block XSS markers in selector parameter (s)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-0968-01": {"ajax_action": "get_megamenu_content", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-0968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0968", "description": "ElementsKit Elementor Addons <=3.4.0 unauthenticated sensitive information exposure via get_megamenu_content AJAX (POST)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-0968-02": {"ajax_action": "get_megamenu_content", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-0968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0968", "description": "ElementsKit Elementor Addons <=3.4.0 unauthenticated sensitive information exposure via get_megamenu_content AJAX (GET)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-0969-01": {"ajax_action": "brizy_get_users", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0969", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0969", "description": "Brizy Page Builder <=2.7.16 authenticated sensitive information exposure via brizy_get_users AJAX action", "mode": "block", "severity": 6.5, "slug": "brizy", "tags": ["missing-authorization", "sensitive-information-exposure", "broken-access-control"], "target": "plugin", "versions": "<=2.7.16"}, "RULE-CVE-2025-10000-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/qyrr/v1/blob-to-file(/|\\\\?|$)~"}, {"name": "ARGS:source", "type": "regex", "value": "~data:[^;]*(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|aspx?|jsp|jspx?|cfm|phtml|user\\\\.ini|htaccess|htpasswd)[^;]*;base64~i"}], "cve": "CVE-2025-10000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10000", "description": "Qyrr - simply and modern QR-Code creation <=2.0.7 authenticated (Contributor+) arbitrary file upload via blob-to-file REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qyrr-code", "tags": ["arbitrary-file-upload", "unrestricted-file-type", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2025-10000-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/qyrr/v1/blob-to-file(/|\\\\?|$)~"}, {"name": "ARGS:format", "type": "regex", "value": "~^(?:\\\\.)?(?:ph(?:p\\\\d?|s|tml?|t|ar|gif)|phtml|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2025-10000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10000", "description": "Qyrr - simply and modern QR-Code creation <=2.0.7 authenticated (Contributor+) arbitrary file upload via blob-to-file REST endpoint - format parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qyrr-code", "tags": ["arbitrary-file-upload", "unrestricted-file-type", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2025-10002-01": {"ajax_action": "clickwhale/admin/export_csv", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2025-10002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10002", "description": "ClickWhale <=2.5.0 authenticated SQL injection via id parameter in export_csv AJAX handler", "mode": "block", "severity": 4.9, "slug": "clickwhale", "tags": ["sql-injection", "authenticated", "csv-export"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-10036-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_fifu(/|\\\\?|$)~"}, {"name": "ARGS:keyword", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)|(?:\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b)|(?:\\\\bSELECT\\\\s+.+\\\\bFROM\\\\b)|(?:\\\\b(?:INSERT|UPDATE|DELETE|DROP|ALTER|EXEC)\\\\b(?=.*(?:[\'\\"`;]|--\\\\s|/\\\\*)))|(?:;|--\\\\s|/\\\\*)|(?:\\\\bSLEEP\\\\s*\\\\()|(?:\\\\bBENCHMARK\\\\s*\\\\()|(?:\\\\bEXTRACTVALUE\\\\b)|(?:\\\\bUPDATEXML\\\\b)~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via keyword parameter in list_all_fifu REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_fifu(/|\\\\?|$)~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:OR|AND|UNION|;|--|#))|(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\()|(?:\\\\b(?:ASC|DESC)\\\\b\\\\s*,\\\\s*\\\\()|(?:\\\\)\\\\s*(?:OR|AND|UNION))~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via type parameter in list_all_fifu REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_media_library(/|\\\\?|$)~"}, {"name": "ARGS:keyword", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)|(?:\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b)|(?:\\\\bSELECT\\\\s+.+\\\\bFROM\\\\b)|(?:\\\\b(?:INSERT|UPDATE|DELETE|DROP|ALTER|EXEC)\\\\b(?=.*(?:[\'\\"`;]|--\\\\s|/\\\\*)))|(?:;|--\\\\s|/\\\\*)|(?:\\\\bSLEEP\\\\s*\\\\()|(?:\\\\bBENCHMARK\\\\s*\\\\()|(?:\\\\bEXTRACTVALUE\\\\b)|(?:\\\\bUPDATEXML\\\\b)~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via keyword parameter in list_all_media_library REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_media_library(/|\\\\?|$)~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:OR|AND|UNION|;|--|#))|(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\()|(?:\\\\b(?:ASC|DESC)\\\\b\\\\s*,\\\\s*\\\\()|(?:\\\\)\\\\s*(?:OR|AND|UNION))~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via type parameter in list_all_media_library REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10039-01": {"ajax_action": "eh_crm_ticket_single_view_client", "conditions": [{"name": "ARGS:ticket_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10039", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.2.9 IDOR via eh_crm_ticket_single_view_client allows Subscriber+ to read any ticket", "method": "POST", "mode": "block", "severity": 4.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["idor", "missing-authorization", "insecure-direct-object-reference", "information-disclosure"], "target": "plugin", "versions": "<=3.2.9"}, "RULE-CVE-2025-10041-01": {"ajax_action": "flexqr_save_qr", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:PD9waHA|PD8g|PD8J|PD8N|PD8K)~"}], "cve": "CVE-2025-10041", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-10041-02": {"ajax_action": "flexqr_update_qr", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:PD9waHA|PD8g|PD8J|PD8N|PD8K)~"}], "cve": "CVE-2025-10041", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-10045-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:^|[\\\\\\\\/])onoffice-estates[\\\\\\\\/]*$~"}, {"name": "ARGS:order", "type": "regex", "value": "~[^A-Za-z0-9_-]~"}], "cve": "CVE-2025-10045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10045", "description": "onOffice for WP-Websites <=6.5.1 authenticated SQL injection via the order parameter", "method": "GET", "mode": "block", "severity": 4.9, "slug": "onoffice-for-wp-websites", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-10045-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:^|[\\\\\\\\/])onoffice-estates[\\\\\\\\/]*$~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~[^A-Za-z0-9_-]~"}], "cve": "CVE-2025-10045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10045", "description": "onOffice for WP-Websites <=6.5.1 authenticated SQL injection via the orderby parameter", "method": "GET", "mode": "block", "severity": 4.9, "slug": "onoffice-for-wp-websites", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-10046-01": {"ajax_action": "elex_gpf_manage_feed_remove_file", "conditions": [{"name": "ARGS:file_to_delete", "type": "detectSQLi"}], "cve": "CVE-2025-10046", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10046", "description": "ELEX WooCommerce Google Shopping <=1.4.3 authenticated SQL injection via file_to_delete in feed removal AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "elex-woocommerce-google-product-feed-plugin-basic", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-10047-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-tracker"}, {"name": "ARGS:orderby", "type": "regex", "value": "~[(),\'\\"`]|\\\\bselect\\\\b|\\\\bcase\\\\b|\\\\bwhen\\\\b|\\\\bsleep\\\\b|\\\\bunion\\\\b|--\\\\s|/\\\\*~i"}], "cve": "CVE-2025-10047", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10047", "description": "Email Tracker <=5.3.15 authenticated (Admin+) SQL injection via orderby parameter in email list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "email-tracker", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=5.3.15"}, "RULE-CVE-2025-10048-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^gjmaa_~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:ASC|DESC)\\\\s*(?:--|#)))~i"}], "cve": "CVE-2025-10048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10048", "description": "My Auctions Allegro <=3.6.31 authenticated SQL injection via order parameter in admin list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "my-auctions-allegro-free-edition", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.6.31"}, "RULE-CVE-2025-10048-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^gjmaa_~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:ASC|DESC)\\\\s*(?:--|#)))~i"}], "cve": "CVE-2025-10048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10048", "description": "My Auctions Allegro <=3.6.31 authenticated SQL injection via orderby parameter in admin list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "my-auctions-allegro-free-edition", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.6.31"}, "RULE-CVE-2025-10049-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "responsive_portfolio_with_lightbox_media_management"}, {"name": "ARGS:HdnMediaSelection", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|cgi|asp|aspx|jsp|jspx|cfm|shtml)(?:\\\\?|%3[Ff]|%00|$)~i"}], "cve": "CVE-2025-10049", "method": "POST", "mode": "block", "severity": 7.2, "slug": "responsive-filterable-portfolio", "target": "plugin", "versions": "<=1.0.24"}, "RULE-CVE-2025-1005-01": {"action": "init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~elementskit-image-accordion~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1005", "description": "ElementsKit Elementor Addons <=3.4.0 Stored XSS via Image Accordion widget attributes in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-1005-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~elementskit-image-accordion~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1005", "description": "ElementsKit Elementor Addons <=3.4.0 Stored XSS via Image Accordion widget in post content save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-10054-01": {"ajax_action": "eh_crm_remove_agent", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10054", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.3.1 missing authorization on eh_crm_remove_agent AJAX action allows Subscriber+ role removal", "mode": "block", "severity": 4.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["missing-authorization", "broken-access-control", "role-removal"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-10055-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-manage-projects"}, {"name": "ARGS:ProjectName", "type": "regex", "value": "~]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to stored XSS via ProjectName on manage-projects page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-queue-invoice"}, {"name": "ARGS:timesheet_id", "type": "regex", "value": "~]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to reflected XSS via timesheet_id on queue-invoice page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-my-dashboard"}, {"name": "ARGS:team_member", "type": "regex", "value": "~]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to reflected XSS via team_member on my-dashboard page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-manage-projects"}, {"name": "ARGS:notes", "type": "regex", "value": "~]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to stored XSS via notes on manage-projects page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10058-01": {"ajax_action": "get_ftp_url", "conditions": [{"name": "ARGS:HostPath", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10058", "description": "WP Ultimate CSV Importer <=7.27 authenticated arbitrary file deletion via get_ftp_url AJAX action (HostPath path traversal)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wp-ultimate-csv-importer", "tags": ["arbitrary-file-deletion", "path-traversal", "missing-authorization"], "target": "plugin", "versions": "<=7.27"}, "RULE-CVE-2025-10124-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[booking-manager-delete\\\\b~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10124", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10124", "description": "Booking Manager <=2.1.14 unauthorized booking deletion via [booking-manager-delete] shortcode injection in Classic Editor post save", "method": "POST", "mode": "block", "severity": 4.5, "slug": "booking-manager", "tags": ["incorrect-authorization", "shortcode", "broken-access-control"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-10125-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*<(?:script|img|svg|iframe|object|embed|details|math)~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute with script/tag injection (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute with javascript: URI (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute event handler injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*<(?:script|img|svg|iframe|object|embed|details|math)~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute script/tag injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute javascript: URI (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10126-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[mbumap\\\\b[^\\\\]]*(?:]+onerror)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-10126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10126", "description": "MyBrain Utilities <=1.0.8 Stored XSS via mbumap shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mybrain-utilities", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2025-10129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]webcam[^]]*(?:\\\\s+on[a-zA-Z]+\\\\s*=|javascript:|<\\\\s*script|<\\\\s*/\\\\s*script)~i"}], "cve": "CVE-2025-10129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10129", "description": "WP Webcam Widget/Shortcode <=1.2 Stored XSS via [webcam] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-webcam-widget-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]webcam[^]]*(?:\\\\s+on[a-zA-Z]+\\\\s*=|javascript:|<\\\\s*script|<\\\\s*/\\\\s*script)~i"}], "cve": "CVE-2025-10129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10129", "description": "WP Webcam Widget/Shortcode <=1.2 Stored XSS via [webcam] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-webcam-widget-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10136-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tweetthis~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tweetthis[\\\\s\\\\S]*?(?:]*onerror|]*onerror|]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10167", "description": "Stock History & Reports Manager for WooCommerce <=2.2.2 Stored XSS via [alg_wc_stock_snapshot_restocked] shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "stock-snapshot-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-10167-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "[alg_wc_stock_snapshot_restocked"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[alg_wc_stock_snapshot_restocked\\\\s[^\\\\]]*(?:]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10167", "description": "Stock History & Reports Manager for WooCommerce <=2.2.2 Stored XSS via [alg_wc_stock_snapshot_restocked] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "stock-snapshot-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-10181-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[drafts\\\\b[^\\\\]]*template\\\\s*=\\\\s*(?:([\'\\"])(?:(?!\\\\1).)*(?:]*\\\\son[a-zA-Z0-9_]+\\\\s*=|[\'\\"]\\\\s*on[a-zA-Z0-9_]+\\\\s*=|expression\\\\s*\\\\()~i"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via return URL parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:coupon", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via coupon parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:email", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via email parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:paypal", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via paypal parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-07": {"action": "init", "conditions": [{"name": "ARGS:paypal_form_coupon", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 reflected XSS via paypal_form_coupon shortcode parameter (unauthenticated)", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "reflected-xss", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10310-01": {"ajax_action": "easysnippetGet", "conditions": [{"name": "ARGS:last", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\())~i"}, {"name": "ARGS:last", "type": "regex", "value": "~(?i)(?:(?:[\'\\\\\\"]\\\\s*)?\\\\b(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER\\\\s+BY|GROUP\\\\s+BY|SLEEP|BENCHMARK|WAITFOR|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\b|(?:--\\\\s*$)|(?:/\\\\*)|(?:;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)))~"}], "cve": "CVE-2025-10310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10310", "description": "Rich Snippet Site Report <=2.0.0105 authenticated SQL injection via last parameter in easysnippetGet AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "easysnippet", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.0.0105"}, "RULE-CVE-2025-10375-01": {"ajax_action": "accessibe_add_verification_page", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_add_verification_page AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization", "file-creation"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10375-02": {"ajax_action": "accessibe_modify_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_modify_config AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization", "settings-manipulation"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10375-03": {"ajax_action": "accessibe_remove_script", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_remove_script AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10375-04": {"ajax_action": "accessibe_signup", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_signup AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10375-05": {"ajax_action": "accessibe_login", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_login AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10375-06": {"ajax_action": "accessibe_license_trial", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_license_trial AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10376-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "crfl_redirect_setting"}, {"name": "ARGS:id", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-10376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10376", "description": "Course Redirects for Learndash <=0.4 CSRF to reflected XSS via unsanitized id parameter on settings page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "course-redirects-for-learndash", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=0.4"}, "RULE-CVE-2025-10380-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~constant\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|call_user_func|call_user_func_array)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template injection on REST API save endpoint - constant() function abuse", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\|\\\\s*(?:filter|map|reduce|sort)\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig filter chaining with dangerous PHP callables on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~_self\\\\s*\\\\.\\\\s*env\\\\s*\\\\.\\\\s*(?:registerUndefinedFilterCallback|registerUndefinedFunctionCallback|getFilter|getFunction)~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig _self.env callback registration on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~constant\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|call_user_func|call_user_func_array)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template injection on post.php save - constant() function abuse", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~\\\\|\\\\s*(?:filter|map|reduce|sort)\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig filter chaining on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~_self\\\\s*\\\\.\\\\s*env\\\\s*\\\\.\\\\s*(?:registerUndefinedFilterCallback|registerUndefinedFunctionCallback|getFilter|getFunction)~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig _self.env callback registration on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\{[%{](?:(?![%}]\\\\}).)*\\\\b(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|phpinfo|file_get_contents|file_put_contents|fopen)\\\\s*\\\\((?:(?![%}]\\\\}).)*[%}]\\\\}~is"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template with dangerous PHP functions in Twig delimiters on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~\\\\{[%{](?:(?![%}]\\\\}).)*\\\\b(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|phpinfo|file_get_contents|file_put_contents|fopen)\\\\s*\\\\((?:(?![%}]\\\\}).)*[%}]\\\\}~is"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template with dangerous PHP functions in Twig delimiters on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-1043-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[embeddoc[^\\\\]]*\\\\surl\\\\s*=\\\\s*[\\"\']?\\\\s*(?:(?:https?://)?(?:127\\\\.(?:0\\\\.){2}(?:0\\\\.)?1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.0\\\\.0\\\\.1\\\\]?|0x[0-9a-fA-F]+|0[0-7]+|[0-9]{8,10})(?:[:/]|\\\\]|\\\\s|$)|(?:file|gopher|dict|ftp|ldap|tftp)://)~i"}], "cve": "CVE-2025-1043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1043", "description": "Embed Any Document <=2.7.5 authenticated (Contributor+) blind SSRF via [embeddoc] shortcode in post_content stored through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-any-document", "tags": ["ssrf", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-1043-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[embeddoc[^\\\\]]*\\\\surl\\\\s*=\\\\s*[\\"\']?\\\\s*(?:(?:https?://)?(?:127\\\\.(?:0\\\\.){2}(?:0\\\\.)?1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.0\\\\.0\\\\.1\\\\]?|0x[0-9a-fA-F]+|0[0-7]+|[0-9]{8,10})(?:[:/]|\\\\]|\\\\s|$)|(?:file|gopher|dict|ftp|ldap|tftp)://)~i"}], "cve": "CVE-2025-1043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1043", "description": "Embed Any Document <=2.7.5 authenticated (Contributor+) blind SSRF via [embeddoc] shortcode in content stored through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-any-document", "tags": ["ssrf", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-10476-01": {"ajax_action": "wpfc_db_fix", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10476", "mode": "block", "severity": 4.3, "slug": "wp-fastest-cache", "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10487-01": {"ajax_action": "advads_ad_select", "conditions": [{"name": "ARGS:ad_method", "type": "regex", "value": "~^(?!ad$|group$|placement$|id$).+~"}], "cve": "CVE-2025-10487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10487", "description": "Advanced Ads <=2.0.12 unauthenticated limited RCE via ad_method parameter in advads_ad_select AJAX handler", "mode": "block", "severity": 7.3, "slug": "advanced-ads", "tags": ["code-injection", "unauthenticated", "function-injection"], "target": "plugin", "versions": "<=2.0.12"}, "RULE-CVE-2025-1054-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~uicore-(?:counter|icon-box|testimonial-(?:slider|grid|carousel))~"}, {"name": "ARGS", "type": "regex", "value": "~(?:]*>|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:[^\\\\s]|]*\\\\bon\\\\w+\\\\s*=|]*>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1054", "description": "UiCore Elements <=1.0.16 Stored XSS via Counter/Icon Box/Testimonial widgets on REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uicore-elements", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.16"}, "RULE-CVE-2025-10567-01": {"ajax_action": "get_gutenberg_checkout_from_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(script|img|svg|iframe|details|embed|object|math|video|audio|body|input|button|select|textarea|form|marquee|isindex|meta|link|style|base|source|applet)[\\\\s/>]|\\\\bon(error|load|click|mouse\\\\w+|focus|blur|toggle|resize|submit|change|input|key\\\\w+|touch\\\\w+)\\\\s*=~i"}], "cve": "CVE-2025-10567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10567", "description": "FunnelKit <=3.12.0 reflected XSS via unsanitized checkout text fields in get_gutenberg_checkout_from_data AJAX handler", "method": "POST", "mode": "block", "severity": 6.3, "slug": "funnel-builder", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.12.0"}, "RULE-CVE-2025-10570-01": {"ajax_action": "fr_refund_request", "conditions": [{"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10570", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10570", "description": "Flexible Refund and Return Order for WooCommerce <=1.0.38 missing authorization on fr_refund_request AJAX action allows subscriber+ IDOR refund requests", "method": "POST", "mode": "block", "severity": 4.3, "slug": "flexible-refund-and-return-order-for-woocommerce", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.38"}, "RULE-CVE-2025-10579-01": {"ajax_action": "backwpup_working", "conditions": [{"name": "ARGS:jobid", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "backwpup"}], "cve": "CVE-2025-10579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10579", "description": "BackWPup <=5.5.0 missing authorization on backwpup_working AJAX action exposes backup filename to low-privilege users", "mode": "block", "severity": 5.3, "slug": "backwpup", "tags": ["missing-authorization", "information-exposure", "broken-access-control"], "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2025-10580-01": {"ajax_action": "widgetopts_ajax_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<[^>]*\\\\bon\\\\w+\\\\s*=|<\\\\s*(?:script|img|svg|iframe)\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-10580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10580", "description": "Widget Options <=4.1.2 Stored XSS via widgetopts_ajax_settings widget option save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-options", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-10580-02": {"ajax_action": "widgetopts_migrator", "conditions": [{"name": "ARGS:single_sidebar", "type": "detectXSS"}], "cve": "CVE-2025-10580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10580", "description": "Widget Options <=4.1.2 Stored XSS via widgetopts_migrator single_sidebar parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-options", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-10582-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wp_dispatch(?:er)?\\\\s+[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\\\\s+\\\\d|AND\\\\s+\\\\d|SLEEP|BENCHMARK|--|;|/\\\\*|\\\\*/|CHAR\\\\s*\\\\(|CONCAT\\\\s*\\\\(|0x[0-9a-fA-F]{2,}|\\\\\\\\x)[^\\"\'\\\\]]*[\\"\']?~i"}], "cve": "CVE-2025-10582", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10582", "description": "WP Dispatcher <=1.3.0 authenticated (Contributor+) SQL Injection via wp_dispatch shortcode id attribute in post_content (classic editor)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-dispatcher", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-10582-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_dispatch(?:er)?\\\\s+[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\\\\s+\\\\d|AND\\\\s+\\\\d|SLEEP|BENCHMARK|--|;|/\\\\*|\\\\*/|CHAR\\\\s*\\\\(|CONCAT\\\\s*\\\\(|0x[0-9a-fA-F]{2,}|\\\\\\\\x)[^\\"\'\\\\]]*[\\"\']?~i"}], "cve": "CVE-2025-10582", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10582", "description": "WP Dispatcher <=1.3.0 authenticated (Contributor+) SQL Injection via wp_dispatch shortcode id attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-dispatcher", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-10586-01": {"action": "init", "conditions": [{"name": "ARGS:event_name", "type": "exists"}, {"name": "ARGS:event_venue", "type": "detectSQLi"}], "cve": "CVE-2025-10586", "method": "POST", "mode": "block", "severity": 9.8, "slug": "community-events", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-10587-01": {"action": "init", "conditions": [{"name": "ARGS:event_name", "type": "exists"}, {"name": "ARGS:event_category", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-10587", "method": "POST", "mode": "block", "severity": 9.8, "slug": "community-events", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-10587-02": {"action": "init", "conditions": [{"name": "ARGS:event_name", "type": "exists"}, {"name": "ARGS:event_venue", "type": "regex", "value": "~^(?!(?:[0-9]*|customuservenue)$)~"}], "cve": "CVE-2025-10587", "method": "POST", "mode": "block", "severity": 9.8, "slug": "community-events", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-1063-01": {"ajax_action": "rtcl_taxonomy_settings_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1063", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1063", "description": "Classified Listing <=4.0.4 unauthenticated settings exposure via rtcl_taxonomy_settings_export AJAX action", "mode": "block", "severity": 5.3, "slug": "classified-listing", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=4.0.4"}, "RULE-CVE-2025-1064-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[xoo_el_action\\\\b[^\\\\]]*change_to\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-1064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1064", "description": "Login/Signup Popup <= 2.8.5 Stored XSS via xoo_el_action shortcode change_to attribute (javascript:/data: URI injection in href)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-login-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.5"}, "RULE-CVE-2025-1064-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[xoo_el_action\\\\b[^\\\\]]*change_to\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-1064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1064", "description": "Login/Signup Popup <= 2.8.5 Stored XSS via xoo_el_action shortcode change_to attribute (Gutenberg REST API content field)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-login-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.8.5"}, "RULE-CVE-2025-10645-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-reset[/\\\\\\\\](?:.*/)?wf-licensing\\\\.log([?#]|$)~i"}], "cve": "CVE-2025-10645", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10645", "description": "WP Reset <=2.05 unauthenticated sensitive information exposure via wf-licensing.log direct file access", "method": "GET", "mode": "block", "severity": 5.3, "slug": "wp-reset", "tags": ["information-disclosure", "sensitive-log-file", "unauthenticated"], "target": "plugin", "versions": "<=2.05"}, "RULE-CVE-2025-10647-01": {"ajax_action": "epdf_wf_download_pdf_media", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:\\\\.|%2e)(?:ph(?:p\\\\d*|ar|ps|t|tml?)|phtml)(?:\\\\?|#|$)~i"}], "cve": "CVE-2025-10647", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10647", "description": "Embed PDF for WPForms <=1.1.5 arbitrary file upload via dangerous file extension in url parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "embed-pdf-wpforms", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-10649-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^usces_(?:orderlist|memberlist|itemedit)$~"}, {"name": "REQUEST_COOKIES:usces_cookie", "type": "regex", "value": "~(?:sortColumn|sortSwitchs)[^;]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CONCAT|BENCHMARK|SLEEP|ORDER\\\\s+BY|AND\\\\s+|OR\\\\s+[\\\\d\\"\\\\\']|[\\\\\'\\\\\\"]\\\\s*(?:--|#))~i"}], "cve": "CVE-2025-10649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10649", "description": "Welcart e-Commerce <=2.11.21 authenticated (Author+) SQL injection via usces_cookie sortColumn/sortSwitchs in admin list pages", "method": "GET", "mode": "block", "severity": 6.5, "slug": "usc-e-shop", "tags": ["sql-injection", "cookie-injection", "authenticated"], "target": "plugin", "versions": "<=2.11.21"}, "RULE-CVE-2025-1065-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:type", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via type parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:library", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via library parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:date", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via date parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:source", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via source parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via s (search) parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:orderby", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via orderby parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:order", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via order parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-10660-01": {"ajax_action": "dashboard_chat", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~^(?!(?:[0-9]*|NaN)$)~D"}], "cve": "CVE-2025-10660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10660", "description": "WP Dashboard Chat <=1.0.3 authenticated SQL injection via the id parameter", "mode": "block", "severity": 6.5, "slug": "wp-dashboard-chat", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10679-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/reviewx/api/v1/reviews/bulk/ten/response(?:[/?]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10679", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10679", "description": "ReviewX <=2.2.12 unauthenticated limited code execution via bulkTenReviews REST endpoint", "method": "POST", "mode": "block", "severity": 7.3, "slug": "reviewx", "tags": ["code-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.2.12"}, "RULE-CVE-2025-10682-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tariffuxx_configurator[^\\\\]]*\\\\bid\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|EXEC|SLEEP|BENCHMARK|LOAD_FILE|INTO\\\\s+OUTFILE|INTO\\\\s+DUMPFILE)\\\\b|--|#|/\\\\*|\'\\\\s*(?:OR|AND)(?:\\\\s|[\'\\"(]))~i"}], "cve": "CVE-2025-10682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10682", "description": "TARIFFUXX <=1.4 SQL injection via tariffuxx_configurator shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "tariffuxx", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10683-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-subscription-with-secure-captcha"}, {"name": "ARGS:uid", "type": "detectSQLi"}], "cve": "CVE-2025-10683", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10683", "description": "Easy Email Subscription <=1.3 authenticated SQL injection via uid parameter on admin edit subscriber page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "email-subscription-with-secure-captcha", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10683-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-subscription-with-secure-captcha"}, {"name": "ARGS:uid", "type": "detectSQLi"}], "cve": "CVE-2025-10683", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10683", "description": "Easy Email Subscription <=1.3 authenticated SQL injection via uid parameter on admin edit subscriber page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "email-subscription-with-secure-captcha", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10686-01": {"ajax_action": "cretats_get_preview_html", "conditions": [{"name": "ARGS:cretats_layout", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2025-10686", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10686", "description": "Creta Testimonial Showcase <=1.2.3 authenticated Local File Inclusion via cretats_layout parameter in cretats_get_preview_html AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "creta-testimonial-showcase", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-10701-01": {"ajax_action": "etimeclockwp_timeclock_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|svg|math|form)\\\\b~i"}], "cve": "CVE-2025-10701", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10701", "description": "Time Clock <= 1.3.1 Stored XSS via etimeclockwp_timeclock_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "time-clock", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-10745-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]banhammer-process_~"}], "cve": "CVE-2025-10745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10745", "description": "Banhammer <=3.4.8 unauthenticated protection mechanism bypass via predictable banhammer-process_ GET parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "banhammer", "tags": ["protection-bypass", "predictable-secret", "unauthenticated"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-10748-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "rapidresult"}, {"name": "ARGS:s", "type": "regex", "value": "~\'\\\\s*(?:(?:OR|AND)\\\\s+[^\']{0,40}(?:--|#|/[*])|(?:OR|AND)\\\\s+[0-9]+\\\\s*[=<>]|(?:OR|AND)\\\\s*[(]\\\\s*SELECT\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)|SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]~i"}], "cve": "CVE-2025-10748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10748", "description": "RapidResult <=1.2 authenticated (Contributor+) SQL injection via s parameter in admin search", "method": "GET", "mode": "block", "severity": 6.5, "slug": "rapidresult", "tags": ["sql-injection", "authenticated", "admin-search"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10749-01": {"ajax_action": "azure-storage-media-replace", "conditions": [{"name": "ARGS:replace_attachment", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-10749", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10749", "description": "Microsoft Azure Storage for WordPress <=4.5.1 missing authorization on azure-storage-media-replace AJAX action allows authenticated subscribers to delete arbitrary media", "method": "POST", "mode": "block", "severity": 5.4, "slug": "windows-azure-storage", "tags": ["missing-authorization", "broken-access-control", "arbitrary-media-deletion"], "target": "plugin", "versions": "<=4.5.1"}, "RULE-CVE-2025-10754-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "docodoco-store-locator"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10754", "description": "DocoDoco Store Locator <=1.0.1 authenticated (Editor+) arbitrary file upload via ZIP import", "method": "POST", "mode": "block", "severity": 7.2, "slug": "docodoco-store-locator", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-10862-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-builder-block/v1/popup/logs(/|\\\\?|&|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-10862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10862", "description": "PopupKit <=2.1.3 unauthenticated SQL injection via id parameter on PUT /popup/logs REST endpoint", "method": "PUT", "mode": "block", "severity": 7.5, "slug": "popup-builder-block", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10862-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-builder-block/v1/popup/logs(/|\\\\?|&|$)~"}, {"name": "ARGS:campaignId", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-10862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10862", "description": "PopupKit <=2.1.3 unauthenticated SQL injection via campaignId parameter on GET /popup/logs REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "popup-builder-block", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10873-02": {"ajax_action": "elementinvader_addons_for_elementor_forms_send_form", "conditions": [{"name": "ARGS:mail_data_from_email", "type": "exists"}], "cve": "CVE-2025-10873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10873", "description": "ElementInvader Addons for Elementor <=1.4.0 unauthenticated arbitrary email sending via mail_data_from_email parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementinvader-addons-for-elementor", "tags": ["missing-authorization", "email-spoofing", "unauthenticated"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10873-03": {"ajax_action": "elementinvader_addons_for_elementor_forms_send_form", "conditions": [{"name": "ARGS:mail_data_from_name", "type": "exists"}], "cve": "CVE-2025-10873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10873", "description": "ElementInvader Addons for Elementor <=1.4.0 unauthenticated arbitrary email sending via mail_data_from_name parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementinvader-addons-for-elementor", "tags": ["missing-authorization", "email-spoofing", "unauthenticated"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10874-01": {"ajax_action": "handle-request-mystock", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^(?!https?://([a-z0-9-]+\\\\.)*static\\\\.?flickr\\\\.com(/|$)).+~i"}], "cve": "CVE-2025-10874", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10874", "description": "Orbit Fox by ThemeIsle <=3.0.1 authenticated SSRF via MyStock image import (handle-request-mystock)", "method": "POST", "mode": "block", "severity": 5.5, "slug": "themeisle-companion", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-10902-01": {"ajax_action": "origaich_ai_scan_result_remove", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10902", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10902", "description": "Originality.ai AI Checker <=1.0.15 missing authorization on scan log deletion via origaich_ai_scan_result_remove AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "originality-ai", "tags": ["missing-authorization", "broken-access-control", "data-deletion"], "target": "plugin", "versions": "<=1.0.15"}, "RULE-CVE-2025-10916-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/formgent/responses/attachments(?:/|\\\\?|&|$)~"}, {"name": "ARGS:file_token", "type": "regex", "value": "~(?:Li4v|Li5c)~"}], "cve": "CVE-2025-10916", "method": "DELETE", "mode": "block", "severity": 9.1, "slug": "formgent", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-11003-01": {"ajax_action": "uip_save_ui_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11003", "description": "UiPress lite <=3.5.08 missing authorization on uip_save_ui_template AJAX handler allows Subscriber+ Stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uipress-lite", "tags": ["missing-authorization", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.08"}, "RULE-CVE-2025-11003-02": {"ajax_action": "uip_create_new_ui_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11003", "description": "UiPress lite <=3.5.08 missing authorization on uip_create_new_ui_template AJAX handler allows Subscriber+ template creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uipress-lite", "tags": ["missing-authorization", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.08"}, "RULE-CVE-2025-11007-01": {"ajax_action": "ce21_single_sign_on_save_api_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11007", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ce21-suite", "target": "plugin", "versions": ">=2.2.1 <=2.3.1"}, "RULE-CVE-2025-11128-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/feedzy/v1/feed(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~https?://(?:127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?)~i"}], "cve": "CVE-2025-11128", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11128", "description": "Feedzy RSS Feeds Lite <=5.1.0 authenticated SSRF via REST API url parameter targeting internal/private IPs", "method": "POST", "mode": "block", "severity": 5.0, "slug": "feedzy-rss-feeds", "tags": ["ssrf", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2025-11162-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:meta[uagb_custom_page_level_css]", "type": "regex", "value": "~]*>|]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11162", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.14 Authenticated (Contributor+) Stored XSS via Custom CSS in REST API post meta", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.19.14"}, "RULE-CVE-2025-11162-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:meta[uagb_custom_page_level_css]", "type": "regex", "value": "~]*>|]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11162", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.14 Authenticated (Contributor+) Stored XSS via Custom CSS in classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "classic-editor", "authenticated"], "target": "plugin", "versions": "<=2.19.14"}, "RULE-CVE-2025-11171-01": {"ajax_action": "ays_chart_admin_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_admin_ajax AJAX handler allowing unauthenticated admin method dispatch", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-02": {"ajax_action": "ays_chart_install_plugin", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_install_plugin AJAX handler allowing unauthenticated plugin installation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-03": {"ajax_action": "ays_chart_activate_plugin", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_activate_plugin AJAX handler allowing unauthenticated plugin activation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-05": {"ajax_action": "ays_chart_dismiss_button", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_dismiss_button AJAX handler allowing unauthenticated notice dismissal", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11174-01": {"ajax_action": "dll_load_posts", "conditions": [{"name": "ARGS:args[status]", "type": "regex", "value": "~^(?:draft|pending|future|private|any)$~i"}], "cve": "CVE-2025-11174", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11174", "description": "Document Library Lite <=1.1.6 unauthenticated sensitive information exposure via dll_load_posts AJAX handler args[status] parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "document-library-lite", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-11177-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:log", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\())~i"}], "cve": "CVE-2025-11177", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11177", "description": "External Login <=1.11.1 unauthenticated SQL injection via log parameter on wp-login.php", "method": "POST", "mode": "block", "severity": 7.5, "slug": "external-login", "tags": ["sql-injection", "unauthenticated", "login-bypass"], "target": "plugin", "versions": "<=1.11.1"}, "RULE-CVE-2025-11185-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cmplz-accept-link\\\\b[^\\\\]]*(?:on[a-z]+=|]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle)\\\\s*=~i"}], "cve": "CVE-2025-1123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1123", "description": "Solid Mail (WP SMTP) <=2.1.5 stored XSS via test email fields in solidwp_mail_send_test_email AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-smtp", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.5"}, "RULE-CVE-2025-11254-01": {"ajax_action": "post_cg_gallery_form_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^[\\\\s\\\\t]*(=|\\\\+|\\\\-|@)~"}], "cve": "CVE-2025-11254", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11254", "description": "Contest Gallery <=27.0.3 unauthenticated CSV injection via gallery form upload submissions", "method": "POST", "mode": "block", "severity": 4.3, "slug": "contest-gallery", "tags": ["csv-injection", "formula-injection", "unauthenticated"], "target": "plugin", "versions": "<=27.0.3"}, "RULE-CVE-2025-11254-03": {"ajax_action": "post_cg_registry", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^[\\\\s\\\\t]*(=|\\\\+|\\\\-|@)~"}], "cve": "CVE-2025-11254", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11254", "description": "Contest Gallery <=27.0.3 unauthenticated CSV injection via registry submissions", "method": "POST", "mode": "block", "severity": 4.3, "slug": "contest-gallery", "tags": ["csv-injection", "formula-injection", "unauthenticated"], "target": "plugin", "versions": "<=27.0.3"}, "RULE-CVE-2025-11256-01": {"action": "admin_post_nopriv_delete_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated log file deletion via admin_post_nopriv_delete_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-02": {"action": "admin_post_nopriv_delete_all_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated bulk log deletion via admin_post_nopriv_delete_all_logs", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-03": {"action": "admin_post_nopriv_download_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated log file download via admin_post_nopriv_download_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-read", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-04": {"action": "admin_post_nopriv_fix_permissions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated permission fix via admin_post_nopriv_fix_permissions", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-05": {"action": "admin_post_nopriv_download_widget_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated widget log download via admin_post_nopriv_download_widget_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-read", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-06": {"action": "admin_post_nopriv_delete_widget_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated widget log deletion via admin_post_nopriv_delete_widget_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-07": {"action": "admin_post_nopriv_delete_all_widget_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated bulk widget log deletion via admin_post_nopriv_delete_all_widget_logs", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-09": {"ajax_action": "chatbot_chatgpt_upload_files", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated limited file upload via chatbot_chatgpt_upload_files AJAX", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11262-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/link-whisper/ai-auth(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_id", "type": "regex", "value": "~<\\\\s{0,8}/?\\\\s{0,8}[a-z]|%3c\\\\s{0,8}(?:%2f)?\\\\s{0,8}[a-z]|\\\\bon\\\\w{1,24}\\\\s{0,8}=|javascript\\\\s{0,8}:~i"}], "cve": "CVE-2025-11262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11262", "description": "Link Whisper Free <=0.9.0 unauthenticated stored XSS via the user_id parameter of the ai-auth REST endpoint (POST /wp-json/link-whisper/ai-auth)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "link-whisper", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=0.9.0"}, "RULE-CVE-2025-11271-01": {"action": "init", "conditions": [{"name": "ARGS:verification_override", "type": "exists"}], "cve": "CVE-2025-11271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11271", "description": "Easy Digital Downloads <=3.5.2 PayPal IPN verification bypass via verification_override parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "easy-digital-downloads", "tags": ["verification-bypass", "unauthenticated", "payment-fraud", "cwe-807"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-11307-01": {"ajax_action": "wpgmza_rest_api_request", "conditions": [{"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2025-11307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11307", "description": "WP Go Maps <9.0.48 unauthenticated stored XSS via wpgmza_rest_api_request AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-maps", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<9.0.48"}, "RULE-CVE-2025-11307-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpgmza/v1/~"}, {"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2025-11307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11307", "description": "WP Go Maps <9.0.48 unauthenticated stored XSS via REST API /wpgmza/v1/ endpoints", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-maps", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<9.0.48"}, "RULE-CVE-2025-11361-01": {"ajax_action": "save_ai_generated_image", "conditions": [{"name": "ARGS:image_url", "type": "regex", "value": "~(?:^|[/\\\\\\\\@])(?:127\\\\.(?:0\\\\.){2}1|0\\\\.0\\\\.0\\\\.0|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|localhost|\\\\[::1\\\\])~i"}], "cve": "CVE-2025-11361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11361", "description": "Essential Blocks <=5.7.1 authenticated (Author+) SSRF via save_ai_generated_image AJAX handler - internal/private IP targets", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=5.7.1"}, "RULE-CVE-2025-11361-02": {"ajax_action": "save_ai_generated_image", "conditions": [{"name": "ARGS:image_url", "type": "regex", "value": "~^\\\\s*(?:gopher|file|dict|ftp|data|ldap|telnet|tftp|jar|netdoc)\\\\s*:~i"}], "cve": "CVE-2025-11361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11361", "description": "Essential Blocks <=5.7.1 authenticated (Author+) SSRF via save_ai_generated_image AJAX handler - dangerous URL schemes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=5.7.1"}, "RULE-CVE-2025-11369-01": {"ajax_action": "get_instagram_access_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on get_instagram_access_token AJAX action allows Author+ to read Instagram API token", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11369-02": {"ajax_action": "google_map_api_key", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on google_map_api_key AJAX action allows Author+ to read Google Maps API key", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11369-03": {"ajax_action": "openverse_email_name_DB", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on openverse_email_name_DB AJAX action allows Author+ to read OpenVerse API credentials", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11370-01": {"ajax_action": "depicter-document-rules-store", "conditions": [{"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11370", "description": "Depicter <=4.0.7 missing authorization on unauthenticated display rule update via depicter-document-rules-store AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "depicter", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-11370-02": {"ajax_action": "depicter-document-rules-show", "conditions": [{"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11370", "description": "Depicter <=4.0.7 missing authorization on unauthenticated display rule read via depicter-document-rules-show AJAX action", "method": "GET", "mode": "block", "severity": 5.3, "slug": "depicter", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-11372-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "lp/v1/admin/tools/create-indexs"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11372", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11372", "description": "LearnPress \\u2013 WordPress LMS Plugin Admin Tools REST create-indexs endpoint is exposed without authorization because it is registered with permission_callback set to __return_true, allowing unauthenticated destructive database operations (dropping indexes on any table including wp_options, creating duplicate configuration entries, and degrading performance) via /wp-json/lp/v1/admin/tools/create-indexs when table names are supplied.", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "tags": ["missing-authorization", "rest-api", "unauthenticated", "database-manipulation"], "target": "plugin", "versions": "<=4.2.9.3"}, "RULE-CVE-2025-11377-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*post_status\\\\s*=\\\\s*[\\"\']?(?:private|draft|pending|future|any|trash)[\\"\']?~i"}, {"type": "missing_capability", "value": "read_private_posts"}], "cve": "CVE-2025-11377", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11377", "description": "List Category Posts <=0.92.0 information exposure via catlist shortcode post_status attribute", "method": "POST", "mode": "block", "severity": 4.3, "slug": "list-category-posts", "tags": ["information-exposure", "shortcode", "authorization-bypass"], "target": "plugin", "versions": "<=0.92.0"}, "RULE-CVE-2025-11377-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*post_status\\\\s*=\\\\s*[\\"\']?(?:private|draft|pending|future|any|trash)[\\"\']?~i"}, {"type": "missing_capability", "value": "read_private_posts"}], "cve": "CVE-2025-11377", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11377", "description": "List Category Posts <=0.92.0 information exposure via catlist shortcode post_status attribute (REST API)", "method": "POST", "mode": "block", "severity": 4.3, "slug": "list-category-posts", "tags": ["information-exposure", "shortcode", "authorization-bypass", "rest-api"], "target": "plugin", "versions": "<=0.92.0"}, "RULE-CVE-2025-11379-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~\\\\/wp-content\\\\/webp-express\\\\/config\\\\/.*\\\\.json~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11379", "description": "WebP Express <=0.25.9 unauthenticated information disclosure via predictable config.json file path", "method": "GET", "mode": "block", "severity": 5.3, "slug": "webp-express", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=0.25.9"}, "RULE-CVE-2025-11380-01": {"ajax_action": "everest_process_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11380", "description": "Everest Backup <=2.3.5 missing authorization on everest_process_status AJAX action leading to unauthenticated backup file location disclosure", "mode": "block", "severity": 5.9, "slug": "everest-backup", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11380-02": {"ajax_action": "everest_backup_process_status_unlink", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11380", "description": "Everest Backup <=2.3.5 missing authorization on everest_backup_process_status_unlink AJAX action allowing unauthenticated status file deletion", "mode": "block", "severity": 5.9, "slug": "everest-backup", "tags": ["missing-authorization", "data-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11427-01": {"ajax_action": "wpmdb_flush", "conditions": [{"name": "ARGS:download", "type": "regex", "value": "~(?:https?|ftp|file|php|data|phar|compress\\\\.(?:zlib|bzip2)|zip|glob|expect)://~i"}], "cve": "CVE-2025-11427", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11427", "description": "WP Migrate Lite <=2.7.6 unauthenticated blind SSRF via wpmdb_flush AJAX download parameter", "method": "POST", "mode": "block", "severity": 5.8, "slug": "wp-migrate-db", "tags": ["ssrf", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2025-11448-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/envira-convert/v1/bulk-convert(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11448", "description": "Envira Gallery Lite <=1.11.0 missing authorization on bulk-convert REST endpoint", "method": "POST", "mode": "block", "severity": 4.3, "slug": "envira-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2025-11451-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/aal_ajax_unit_loading(/|\\\\?|&|$)~"}, {"name": "ARGS:data[template_path]", "type": "exists"}], "cve": "CVE-2025-11451", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11451", "description": "Auto Amazon Links <=5.4.3 unauthenticated arbitrary file read via template_path in REST API", "mode": "block", "severity": 7.5, "slug": "amazon-auto-links", "target": "plugin", "versions": "<=5.4.3"}, "RULE-CVE-2025-11453-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:_inpost_head_script[synth_header_script]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11453", "description": "Header and Footer Scripts <=2.2.2 Stored XSS via _inpost_head_script post meta field by Contributor+ users", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-scripts", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-11454-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "eos_scfm_duplicate_post_as_draft"}, {"name": "ARGS:post", "type": "regex", "value": "~[^0-9]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11454", "description": "Specific Content For Mobile <=0.5.5 authenticated SQL injection via post parameter in eos_scfm_duplicate_post_as_draft admin action", "method": "GET", "mode": "block", "severity": 6.5, "slug": "specific-content-for-mobile", "tags": ["sql-injection", "authenticated", "contributor"], "target": "plugin", "versions": "<=0.5.5"}, "RULE-CVE-2025-11457-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/easycommerce/v1/orders(?:/|[?&]|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author|contributor|admin)$~i"}], "cve": "CVE-2025-11457", "method": "POST", "mode": "block", "severity": 9.8, "slug": "easycommerce", "target": "plugin", "versions": ">=0.9.0-beta2 <=1.8.2"}, "RULE-CVE-2025-11496-01": {"action": "init", "conditions": [{"name": "ARGS:rtb-name", "type": "detectXSS"}], "cve": "CVE-2025-11496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11496", "description": "Five Star Restaurant Reservations <=2.7.5 unauthenticated stored XSS via rtb-name booking form parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "restaurant-reservations", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-11499-01": {"action": "init", "conditions": [{"name": "ARGS:post_featured_image", "type": "regex", "value": "~https?://[^\\\\s\\"\'<>]+\\\\.(?:ph(?:p\\\\d?|ps|tml?|t|ar)|[aj]sp[x]?|cgi|cfm|exe|bash)(?:[?#]|$)~i"}], "cve": "CVE-2025-11499", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tablesome", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-11502-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[saswp_tiny_multiple_faq\\\\b[^\\\\]]*(?:]*autoplay|]*(?:onerror|onload|onsrc)\\\\s*=)~i"}], "cve": "CVE-2025-11502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11502", "description": "Schema & Structured Data for WP & AMP <=1.51 Stored XSS via saswp_tiny_multiple_faq shortcode dangerous HTML elements in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.51"}, "RULE-CVE-2025-11504-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-content[/\\\\\\\\]plugins[/\\\\\\\\]quickcreator[/\\\\\\\\]dupasrala\\\\.txt~i"}], "cve": "CVE-2025-11504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11504", "description": "Quickcreator <=0.1.17 unauthenticated sensitive API key exposure via dupasrala.txt static file", "method": "GET", "mode": "block", "severity": 7.5, "slug": "quickcreator", "tags": ["information-disclosure", "sensitive-data-exposure", "unauthenticated", "cwe-532"], "target": "plugin", "versions": "<=0.1.17"}, "RULE-CVE-2025-11510-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/filebird/v1/fb-wipe-clear-all-data(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11510", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11510", "description": "FileBird <=6.4.9 missing authorization on fb-wipe-clear-all-data REST endpoint allows author+ to reset plugin data", "method": "POST", "mode": "block", "severity": 4.3, "slug": "filebird", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=6.4.9"}, "RULE-CVE-2025-11536-01": {"ajax_action": "import_elementor_template", "conditions": [{"name": "ARGS:import_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11536", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11536", "description": "Element Pack Addons for Elementor <=8.2.5 authenticated (Subscriber+) blind SSRF via import_elementor_template AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "bdthemes-element-pack-lite", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.2.5"}, "RULE-CVE-2025-11536-02": {"ajax_action": "import_ep_elementor_bundle_template", "conditions": [{"name": "ARGS:import_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11536", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11536", "description": "Element Pack Addons for Elementor <=8.2.5 authenticated (Subscriber+) blind SSRF via import_ep_elementor_bundle_template AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "bdthemes-element-pack-lite", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.2.5"}, "RULE-CVE-2025-11564-01": {"ajax_action": "tutor_handle_api_calls", "conditions": [{"name": "ARGS:payment_type", "type": "equals", "value": "recurring"}], "cve": "CVE-2025-11564", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11564", "description": "Tutor LMS <=3.8.3 unauthenticated payment verification bypass via forged recurring payment webhook", "method": "POST", "mode": "block", "severity": 5.3, "slug": "tutor", "tags": ["missing-authorization", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2025-11576-01": {"ajax_action": "newcodebyte_chatbot_send_message", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~^\\\\s*[=+\\\\-@]~"}], "cve": "CVE-2025-11576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11576", "description": "AI Chatbot Free Models <=1.6.5 unauthenticated CSV injection via chat message", "method": "POST", "mode": "block", "severity": 4.3, "slug": "chatbot-ai-free-models", "tags": ["csv-injection", "unauthenticated", "stored-attack"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2025-11587-01": {"action": "admin_post_cnb_apikey_activate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11587", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11587", "description": "Call Now Button <=1.5.3 missing authorization on API key activation via admin_post_cnb_apikey_activate", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2025-11627-01a": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (message)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11627-01b": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:error", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (error)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11627-01c": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:error_msg", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (error_msg)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11632-01": {"ajax_action": "cnb_get_billing_portal", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_billing_portal AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-02": {"ajax_action": "cnb_request_billing_portal", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_request_billing_portal AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-03": {"ajax_action": "cnb_create_chat_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_create_chat_token AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-04": {"ajax_action": "cnb_get_domain_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_domain_status AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-05": {"ajax_action": "cnb_get_checkout", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_checkout AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-06": {"ajax_action": "cnb_get_agency_checkout", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_agency_checkout AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-07": {"ajax_action": "cnb_upgrade_to_yearly", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_upgrade_to_yearly AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-08": {"ajax_action": "cnb_enable_chat", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_enable_chat AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-09": {"ajax_action": "cnb_disable_chat", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_disable_chat AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-10": {"ajax_action": "cnb_get_plans", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_plans AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-11": {"ajax_action": "cnb_time_format", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_time_format AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11691-01": {"ajax_action": "ppom_ajax_validation", "conditions": [{"name": "ARGS:ppom_id", "type": "regex", "value": "~[^0-9,]~"}], "cve": "CVE-2025-11691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11691", "description": "PPOM for WooCommerce <=33.0.15 unauthenticated SQL injection via ppom_id parameter in ppom_ajax_validation AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-product-addon", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=33.0.15"}, "RULE-CVE-2025-11691-02": {"ajax_action": "ppom_ajax_validation", "conditions": [{"name": "ARGS:productmeta_id", "type": "regex", "value": "~[^0-9,]~"}], "cve": "CVE-2025-11691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11691", "description": "PPOM for WooCommerce <=33.0.15 unauthenticated SQL injection via productmeta_id parameter in ppom_ajax_validation AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-product-addon", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=33.0.15"}, "RULE-CVE-2025-11692-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]zip-attachments[/\\\\\\\\]download\\\\.php~i"}, {"name": "ARGS:za_real_filename", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-11692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11692", "description": "Zip Attachments <=1.6 unauthenticated arbitrary file read/delete via download.php path traversal", "method": "GET", "mode": "block", "severity": 5.3, "slug": "zip-attachments", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2025-11692-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]zip-attachments[/\\\\\\\\]download\\\\.php~i"}, {"name": "ARGS:za_real_filename", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-11692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11692", "description": "Zip Attachments <=1.6 unauthenticated arbitrary file read/delete via download.php targeting sensitive files", "method": "GET", "mode": "block", "severity": 5.3, "slug": "zip-attachments", "tags": ["missing-authorization", "arbitrary-file-deletion", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2025-11703-01": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~<[a-z!/][^>]*>~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - HTML tag injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11703-02": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~on(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - DOM event handler injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11703-03": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - javascript URI injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11705-01": {"ajax_action": "GOTMLS_scan", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 authenticated arbitrary file read via GOTMLS_scan AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-02": {"ajax_action": "GOTMLS_View_Quarantine", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_View_Quarantine AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-03": {"ajax_action": "GOTMLS_load_update", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_load_update AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-04": {"ajax_action": "GOTMLS_empty_trash", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_empty_trash AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-05": {"ajax_action": "GOTMLS_whitelist", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_whitelist AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-06": {"ajax_action": "GOTMLS_fix", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_fix AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11706-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "aruba-hispeed-cache"}, {"name": "ARGS:dbstatus", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-11706", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11706", "description": "Aruba HiSpeed Cache <=3.0.2 reflected cross-site scripting via dbstatus parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "aruba-hispeed-cache", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-01": {"ajax_action": "ahsc_reset_options", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on plugin settings AJAX endpoints", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-02": {"ajax_action": "ahsc_enable_purge", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on enable_purge AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-03": {"ajax_action": "ahsc_enable_cron", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on enable_cron AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-04": {"ajax_action": "ahsc_debug_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on debug_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-05": {"ajax_action": "ahsc_xmlrpc_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on xmlrpc_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-06": {"ajax_action": "ahsc_cron_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cron_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-07": {"ajax_action": "ahsc_cron_time", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cron_time AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-08": {"ajax_action": "ahsc_dboptimization", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dboptimization AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-09": {"ajax_action": "ahsc_purge_homepage_on_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_homepage_on_edit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-10": {"ajax_action": "ahsc_purge_archive_on_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_archive_on_edit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-11": {"ajax_action": "ahsc_purge_page_on_new_comment", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_page_on_new_comment AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-12": {"ajax_action": "ahsc_static_cache", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on static_cache AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-13": {"ajax_action": "ahsc_lazy_load", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on lazy_load AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-14": {"ajax_action": "ahsc_html_optimizer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on html_optimizer AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-15": {"ajax_action": "ahsc_dns_preconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dns_preconnect AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-16": {"ajax_action": "ahsc_dns_preconnect_domain_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dns_preconnect_domain_list AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-17": {"ajax_action": "ahsc_cache_warmer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cache_warmer AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-18": {"ajax_action": "ahsc_update_apc_Settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on update_apc_Settings AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-19": {"ajax_action": "ahsc_check_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on check_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-20": {"ajax_action": "ahsc_create_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on create_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-21": {"ajax_action": "ahsc_delete_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on delete_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11726-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fl-controls/v1/~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11726", "description": "Beaver Builder Lite <=2.9.4 missing authorization on fl-controls/v1 REST endpoints allows contributor+ to create/update global presets", "method": "POST", "mode": "block", "severity": 4.3, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.9.4"}, "RULE-CVE-2025-11726-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fl-controls/v1/~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11726", "description": "Beaver Builder Lite <=2.9.4 missing authorization on fl-controls/v1 REST endpoints allows contributor+ to delete global presets", "method": "DELETE", "mode": "block", "severity": 4.3, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.9.4"}, "RULE-CVE-2025-11733-01": {"action": "init", "conditions": [{"name": "ARGS:save_footnotes_made_easy_options", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:pre_footnotes", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11733", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11733", "description": "Footnotes Made Easy <=3.0.7 unauthenticated stored XSS via pre_footnotes settings field", "method": "POST", "mode": "block", "severity": 7.2, "slug": "footnotes-made-easy", "tags": ["xss", "stored-xss", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2025-11733-02": {"action": "init", "conditions": [{"name": "ARGS:save_footnotes_made_easy_options", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:post_footnotes", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11733", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11733", "description": "Footnotes Made Easy <=3.0.7 unauthenticated stored XSS via post_footnotes settings field", "method": "POST", "mode": "block", "severity": 7.2, "slug": "footnotes-made-easy", "tags": ["xss", "stored-xss", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2025-11734-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:(?:^/wp-json)(?:/|%2F)aioseoBrokenLinkChecker(?:/|%2F)v1(?:/|%2F)post|(?:^|&|\\\\?)rest_route=(?:/|%2F)aioseoBrokenLinkChecker(?:/|%2F)v1(?:/|%2F)post)(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-11734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11734", "description": "Broken Link Checker by AIOSEO <=1.2.5 missing authorization on DELETE /aioseoBrokenLinkChecker/v1/post allows contributor+ to trash arbitrary posts", "method": "DELETE", "mode": "block", "severity": 5.4, "slug": "broken-link-checker-seo", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-11745-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[adinserter[^\\\\]]*custom-field\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11745", "description": "Ad Inserter <=2.8.7 Stored XSS via [adinserter custom-field] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ad-inserter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.7"}, "RULE-CVE-2025-11749-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json|[?&]rest_route=)/mwai/v1/[A-Za-z0-9_-]+/messages~"}], "cve": "CVE-2025-11749", "mode": "block", "severity": 9.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-11749-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json|[?&]rest_route=)/mwai/v1/[A-Za-z0-9_-]+/sse~"}], "cve": "CVE-2025-11749", "mode": "block", "severity": 9.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-11754-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gdpr/v1/settings(?:/)?(?:\\\\?|$)~"}, {"name": "ARGS:platform", "type": "equals", "value": "wordpress"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11754", "description": "GDPR Cookie Consent <=4.1.2 unauthenticated information disclosure via gdpr/v1/settings REST endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "gdpr-cookie-consent", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-11755-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/import_recipes(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:https?://|//)[^ \\"\'<>]+\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?# \\"\';,]|$)~i"}], "cve": "CVE-2025-11755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11755", "description": "Delicious Recipes <=1.9.0 authenticated (Contributor+) arbitrary file upload via CSV recipe import REST endpoint /import_recipes", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delicious-recipes", "tags": ["arbitrary-file-upload", "unrestricted-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11755-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/import_recipe_fields(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:https?://|//)[^ \\"\'<>]+\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?# \\"\';,]|$)~i"}], "cve": "CVE-2025-11755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11755", "description": "Delicious Recipes <=1.9.0 authenticated (Contributor+) arbitrary file upload via CSV recipe import REST endpoint /import_recipe_fields", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delicious-recipes", "tags": ["arbitrary-file-upload", "unrestricted-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11758-01": {"ajax_action": "aio_time_clock_lite_admin_js", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11758", "description": "All in One Time Clock Lite <=2.0.3 missing authorization on admin AJAX handler allowing unauthenticated page creation and report download", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aio-time-clock-lite", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-11765-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:editpost|post)$~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:stock[-_]tools)\\\\b[^\\\\]]*\\\\bimage_width\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*(?:]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_y shortcode format attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpsite_postauthor\\\\b[^\\\\]]*\\\\bbefore\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_postauthor shortcode before attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpsite_y\\\\b[^\\\\]]*\\\\bformat\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_y format attribute through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpsite_postauthor\\\\b[^\\\\]]*\\\\bbefore\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_postauthor before attribute through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11805-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[skipto\\\\b[^\\\\]]*(?:(?:time|text|class)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|]*\\\\bon|]*\\\\bon|]~i"}], "cve": "CVE-2025-11820", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11820", "description": "Graphina - Elementor Charts and Graphs <=3.1.8 admin settings Stored XSS via graphina_setting_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "graphina-elementor-charts-and-graphs", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-11821-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode in post content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11821-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:post_content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode in post_content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11821-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11822-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bootstrap_tab\\\\b[^\\\\]]*(?:name|link|active)\\\\s*=\\\\s*(?:\\"[^\\"]*(?:]|]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|change|input|submit|pointerover|mouseenter|dblclick|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11876", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11876", "description": "Mailgun Subscriptions <=1.3.1 Stored XSS via mailgun_subscription_form shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mailgun-subscriptions", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-11881-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/appp/v1/myappp-verify(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11881", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11881", "description": "AppPresser <=4.5.0 unauthenticated information disclosure via myappp-verify REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "apppresser", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2025-11881-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/appp/v1/system-info(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11881", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11881", "description": "AppPresser <=4.5.0 unauthenticated information disclosure via system-info REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "apppresser", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2025-11917-01": {"ajax_action": "wpematico_test_feed", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|tftp)://|://(?:localhost|\\\\[?::1\\\\]?|0x[0-9a-f]|0[0-7]{2,}|127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.)|://[^/?#]*@)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11917", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11917", "description": "WPeMatico RSS Feed Fetcher <=2.8.11 authenticated (Subscriber+) SSRF via wpematico_test_feed AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpematico", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=2.8.11"}, "RULE-CVE-2025-11923-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/llms/v1/students/\\\\d+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11923", "mode": "block", "severity": 8.8, "slug": "lifterlms", "target": "plugin", "versions": ">=3.5.3 <=9.1.0"}, "RULE-CVE-2025-11923-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/llms/v1/instructors/\\\\d+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11923", "mode": "block", "severity": 8.8, "slug": "lifterlms", "target": "plugin", "versions": ">=3.5.3 <=9.1.0"}, "RULE-CVE-2025-11924-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/(?:v1/)?forms/\\\\d+/submissions(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11924", "description": "Ninja Forms <=3.13.2 unauthenticated IDOR on ninja-forms-views REST submissions endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "tags": ["idor", "missing-authorization", "unauthenticated", "rest-api", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.13.2"}, "RULE-CVE-2025-11924-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/(?:v1/)?token/refresh(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11924", "description": "Ninja Forms <=3.13.2 unauthenticated bearer token minting via ninja-forms-views REST token/refresh endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "tags": ["authentication-bypass", "missing-authorization", "unauthenticated", "rest-api", "token-minting"], "target": "plugin", "versions": "<=3.13.2"}, "RULE-CVE-2025-11928-01": {"ajax_action": "cjtoolbox_set_property", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|embed|object|form|meta|base|link)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|input|invalid|reset|search|select|drag|drop|copy|cut|paste|abort|canplay|ended|pause|play|progress|ratechange|seeked|seeking|stalled|suspend|waiting|toggle|popstate|hashchange|beforeunload|unload|message|storage|animationstart|animationend|animationiteration|transitionend)\\\\s*=|javascript\\\\s*:/~i"}], "cve": "CVE-2025-11928", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11928", "description": "CSS & JavaScript Toolbox <=12.0.5 Stored XSS via cjtoolbox_set_property AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "css-javascript-toolbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=12.0.5"}, "RULE-CVE-2025-11928-02": {"ajax_action": "cjtoolbox_create", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|embed|object|form|meta|base|link)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|input|invalid|reset|search|select|drag|drop|copy|cut|paste|abort|canplay|ended|pause|play|progress|ratechange|seeked|seeking|stalled|suspend|waiting|toggle|popstate|hashchange|beforeunload|unload|message|storage|animationstart|animationend|animationiteration|transitionend)\\\\s*=|javascript\\\\s*:/~i"}], "cve": "CVE-2025-11928", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11928", "description": "CSS & JavaScript Toolbox <=12.0.5 Stored XSS via cjtoolbox_create AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "css-javascript-toolbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=12.0.5"}, "RULE-CVE-2025-11976-01": {"action": "admin_init", "conditions": [{"name": "ARGS:fusewp_save_sync_rule", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11976", "description": "FuseWP <=1.1.23.0 CSRF to sync rule creation/edit via missing nonce and capability check on save_changes()", "method": "POST", "mode": "block", "severity": 4.3, "slug": "fusewp", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.23.0"}, "RULE-CVE-2025-11986-01": {"ajax_action": "crypto_connect_ajax_process", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-11986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11986", "description": "Crypto plugin <=2.22 unauthenticated auth bypass and data injection via crypto_connect_ajax_process AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "crypto", "tags": ["missing-authentication", "authentication-bypass", "unauthenticated", "information-exposure"], "target": "plugin", "versions": "<=2.22"}, "RULE-CVE-2025-11987-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[visual-link-preview\\\\b[^\\\\]]*(?:<[a-z/!]|(?:\\\\s|\\"|\')on[a-z]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11987", "description": "Visual Link Preview <=2.2.7 Stored XSS via visual-link-preview shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "visual-link-preview", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-11987-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/)?(?:\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[visual-link-preview\\\\b[^\\\\]]*(?:<[a-z/!]|(?:\\\\s|\\"|\')on[a-z]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11987", "description": "Visual Link Preview <=2.2.7 Stored XSS via visual-link-preview shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "visual-link-preview", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-11994-01": {"action": "init", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~<[a-zA-Z/!]~"}], "cve": "CVE-2025-11994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11994", "description": "Easy Email Subscription <=1.3 unauthenticated stored XSS via subscription form name parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "email-subscription-with-secure-captcha", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-11995-01": {"action": "init", "conditions": [{"name": "ARGS:eventdesc", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event description field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-02": {"action": "init", "conditions": [{"name": "ARGS:eventname", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event name field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-03": {"action": "init", "conditions": [{"name": "ARGS:eventaddress", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event address field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-04": {"action": "init", "conditions": [{"name": "ARGS:eventticket", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event ticket address field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-05": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:year", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via year parameter in community_events_frontend_list AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-06": {"ajax_action": "community_events_admin_list", "conditions": [{"name": "ARGS:currentyear", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via currentyear parameter in community_events_admin_list AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-07": {"ajax_action": "community_events_click_tracker", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via id parameter in community_events_click_tracker AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11999-01": {"ajax_action": "addmultiplemarker_reset_map", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11999", "description": "Add Multiple Marker <=1.2 unauthenticated map reset via addmultiplemarker_reset_map AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "add-multiple-marker", "tags": ["missing-authorization", "unauthenticated", "data-deletion"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-11999-02": {"ajax_action": "amm_save_map_api", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11999", "description": "Add Multiple Marker <=1.2 unauthenticated API key overwrite via amm_save_map_api AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "add-multiple-marker", "tags": ["missing-authorization", "unauthenticated", "settings-manipulation"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-12000-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpfunnels/v1/settings(/|\\\\?|&|$)~"}, {"name": "ARGS:logKey", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2e%2e|%252e%252e)[%/\\\\\\\\]|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|(?:^|[\\\\\\\\/])(?:debug\\\\.log|error_log)(?:$|[\\\\\\\\/])))~i"}], "cve": "CVE-2025-12000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12000", "description": "WPFunnels <=3.6.2 authenticated arbitrary file deletion via path traversal in logKey parameter on REST settings endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpfunnels", "tags": ["path-traversal", "arbitrary-file-deletion", "rest-api"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-12010-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 authenticated (Contributor+) sensitive information exposure via {al:*} shortcode placeholders in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12010-02": {"ajax_action": "update_authors_list_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 unauthenticated sensitive information exposure via update_authors_list_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12010-03": {"ajax_action": "authors_list_display_edit_item_preview_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 authenticated sensitive information exposure via authors_list_display_edit_item_preview_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12018-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[fnd]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[fnd] admin setting (attribute context)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[rsp]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[rsp] admin setting (attribute context)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[mol]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[mol] member login message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[moe]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[moe] membership expired message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[mon]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[mon] no-access message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[moi]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[moi] session expired message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[org]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[org] data attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[out]", "type": "regex", "value": "~(?:javascript\\\\s*:|\\"\\\\s*(?:on\\\\w+\\\\s*=|>)|<\\\\s*(?:script|img|svg|iframe))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[out] logout redirect URL", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[top]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[top] data attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[fbk]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[fbk] Facebook App ID attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-11": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[map]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[map] Google Maps API key attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12021-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:error_description", "type": "detectXSS"}], "cve": "CVE-2025-12021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12021", "description": "WP-OAuth <=0.4.1 Reflected XSS via error_description parameter on wp-login.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-oauth", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-12021-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~login-google\\\\.php~"}, {"name": "ARGS:error_description", "type": "detectXSS"}], "cve": "CVE-2025-12021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12021", "description": "WP-OAuth <=0.4.1 Reflected XSS via error_description parameter on login-google.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-oauth", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-12025-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:sm_ytcs_option[sm_ytcs_title]", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]|]|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12025", "description": "YouTube Subscribe <=3.0.0 Authenticated (Admin+) Stored XSS via title setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "easy-youtube-subscribe", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-12025-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:sm_ytcs_option[sm_youtube_channel_id]", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]|]|]|\\"|\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12025", "description": "YouTube Subscribe <=3.0.0 Authenticated (Admin+) Stored XSS via channel ID setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "easy-youtube-subscribe", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-12028-01": {"action": "login_form_indieauth", "conditions": [{"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF on OAuth authorization POST confirmation via wp-login.php?action=indieauth", "method": "POST", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-02": {"action": "login_form_indieauth", "conditions": [{"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF on OAuth authorization GET initiation via wp-login.php?action=indieauth", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/indieauth/1\\\\.0/auth(?:/|\\\\?|$)~"}, {"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF via REST auth endpoint missing PKCE requirements (/indieauth/1.0/auth)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/indieauth/1\\\\.0/auth(?:/|$)~"}, {"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF via REST auth endpoint missing PKCE requirements (rest_route=/indieauth/1.0/auth)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12032-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_messager", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized messager setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_zalo", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized zalo setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_hotline", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized hotline setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_contact", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized contact setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12034-01": {"action": "admin_init", "conditions": [{"name": "ARGS:fvm_settings[cdn][domain]", "type": "regex", "value": "~[\\"\'<>]~"}], "cve": "CVE-2025-12034", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12034", "description": "Fast Velocity Minify <=3.5.1 Stored XSS via CDN domain settings field (domain key)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fast-velocity-minify", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-12034-02": {"action": "admin_init", "conditions": [{"name": "ARGS:fvm_settings[cdn][url]", "type": "regex", "value": "~[\\"\'<>]~"}], "cve": "CVE-2025-12034", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12034", "description": "Fast Velocity Minify <=3.5.1 Stored XSS via CDN url settings field (legacy url key)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fast-velocity-minify", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-12042-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]course-booking-system[/\\\\\\\\](includes[/\\\\\\\\])?csv-export\\\\.php([?#]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12042", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12042", "description": "Course Booking System <=6.1.5 unauthenticated booking data export via direct access to csv-export.php", "method": "GET", "mode": "block", "severity": 5.3, "slug": "course-booking-system", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-12045-01": {"ajax_action": "add-tag", "conditions": [{"name": "ARGS:tag-name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via taxonomy term name in add-tag AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12045-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/tags(/|\\\\?|&|$)~"}, {"name": "ARGS:name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via tag name through REST /wp/v2/tags endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "rest-api", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12045-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/categories(/|\\\\?|&|$)~"}, {"name": "ARGS:name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via category name through REST /wp/v2/categories endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "rest-api", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12062-01": {"ajax_action": "core_templates", "conditions": [{"name": "ARGS:template_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-12062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12062", "description": "WP Maps plugin <=4.8.6 Local File Inclusion via template_name parameter in core_templates AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-map-plugin", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=4.8.6"}, "RULE-CVE-2025-12062-02": {"ajax_action": "core_templates", "conditions": [{"name": "ARGS:template_type", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-12062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12062", "description": "WP Maps plugin <=4.8.6 Local File Inclusion via template_type parameter in core_templates AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-map-plugin", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=4.8.6"}, "RULE-CVE-2025-12064-01": {"ajax_action": "xyz_fbap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12064", "description": "WP2Social Auto Publish <=2.4.7 Reflected XSS via xyzscripts_user_hash in xyz_fbap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "facebook-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2025-12064-02": {"ajax_action": "xyz_fbap_del_fb_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12064", "description": "WP2Social Auto Publish <=2.4.7 Reflected XSS via xyzscripts_user_hash in xyz_fbap_del_fb_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "facebook-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2025-12066-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wpedpcampaign"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|(?:src|href|action)\\\\s*=\\\\s*[\\"\']?javascript:|xmlns)|<\\\\s*(?:script|iframe|object|embed|svg|math)~i"}], "cve": "CVE-2025-12066", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12066", "description": "WP Delete Post Copies <=6.0.2 stored XSS via campaign meta box fields on save_post", "method": "POST", "mode": "block", "severity": 4.4, "slug": "etruel-del-post-copies", "tags": ["xss", "stored-xss", "admin-plus"], "target": "plugin", "versions": "<=6.0.2"}, "RULE-CVE-2025-12067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~\\"c\\"\\\\s*:\\\\s*\\".*(?:]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|input)\\\\s*=|javascript\\\\s*:).*\\"~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12067", "description": "Table Field Add-on for ACF and SCF <=1.3.30 authenticated (Contributor+) stored XSS via table cell content in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-table-field", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.30"}, "RULE-CVE-2025-12067-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~\\"c\\"\\\\s*:\\\\s*\\".*(?:]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|input)\\\\s*=|javascript\\\\s*:).*\\"~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12067", "description": "Table Field Add-on for ACF and SCF <=1.3.30 authenticated (Contributor+) stored XSS via REST API post update with table cell content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-table-field", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.30"}, "RULE-CVE-2025-12076-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:ln_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via ln_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:th_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via th_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:tw_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via tw_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:xyz_smap_bot_token", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyz_smap_bot_token parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-05": {"ajax_action": "xyz_smap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-06": {"ajax_action": "xyz_smap_del_ln_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_ln_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-07": {"ajax_action": "xyz_smap_del_tw_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_tw_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-08": {"ajax_action": "xyz_smap_del_ig_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_ig_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-09": {"ajax_action": "xyz_smap_del_fb_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_fb_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-10": {"ajax_action": "xyz_smap_del_lnuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_lnuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-11": {"ajax_action": "xyz_smap_del_twuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_twuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-12": {"ajax_action": "xyz_smap_del_iguser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_iguser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12077-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedin-auto-publish"}, {"name": "ARGS:ln_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via ln_auth_err parameter on plugin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12077-02": {"ajax_action": "xyz_lnap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via xyzscripts_user_hash in xyz_lnap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12077-03": {"ajax_action": "xyz_lnap_del_lnuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via xyzscripts_user_hash in xyz_lnap_del_lnuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12089-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]){2,}.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-12089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12089", "description": "Data Tables Generator by Supsystic <=1.10.45 authenticated arbitrary file deletion via path traversal in cleanCache()", "method": "POST", "mode": "block", "severity": 6.5, "slug": "data-tables-generator-by-supsystic", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.10.45"}, "RULE-CVE-2025-12089-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "supsystic-tables"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]){2,}.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-12089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12089", "description": "Data Tables Generator by Supsystic <=1.10.45 authenticated arbitrary file deletion via path traversal in cleanCache() (GET admin page)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "data-tables-generator-by-supsystic", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.10.45"}, "RULE-CVE-2025-12092-01-0": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[0]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-1": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[1]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-2": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[2]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-3": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[3]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-4": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[4]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12099-01": {"ajax_action": "academy/course/import_all_courses", "conditions": [{"name": "ARGS:import_all_courses", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-12099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12099", "description": "Academy LMS <=3.3.8 authenticated PHP Object Injection via import_all_courses AJAX action", "method": "POST", "mode": "block", "severity": 7.2, "slug": "academy", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2025-12109-01": {"action": "init", "conditions": [{"name": "ARGS:asm_header_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_header_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12109-02": {"action": "init", "conditions": [{"name": "ARGS:asm_body_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_body_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12109-03": {"action": "init", "conditions": [{"name": "ARGS:asm_footer_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_footer_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12115-01": {"action": "init", "conditions": [{"name": "ARGS:add-to-cart", "type": "exists"}, {"name": "ARGS:woonp", "type": "exists"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/\\\\?|\\\\?|&)(?:add-to-cart=)~"}], "cve": "CVE-2025-12115", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12115", "description": "WPC Name Your Price for WooCommerce <=2.1.9 unauthenticated price alteration via woonp parameter in add-to-cart POST", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpc-name-your-price", "tags": ["business-logic", "price-manipulation", "unauthenticated", "client-side-enforcement-bypass"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-12115-02": {"action": "init", "conditions": [{"name": "ARGS:woonp", "type": "exists"}], "cve": "CVE-2025-12115", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12115", "description": "WPC Name Your Price for WooCommerce <=2.1.9 unauthenticated price alteration via woonp parameter in GET request", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpc-name-your-price", "tags": ["business-logic", "price-manipulation", "unauthenticated", "client-side-enforcement-bypass"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-12126-01": {"ajax_action": "ttbp_add_chapter", "conditions": [{"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to add chapters to others\' books via ttbp_add_chapter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-02": {"ajax_action": "ttbp_delete_chapter", "conditions": [{"name": "ARGS:chapter_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to delete others\' chapters via ttbp_delete_chapter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-03": {"ajax_action": "ttbp_update_chapter_order", "conditions": [{"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to reorder others\' chapters via ttbp_update_chapter_order", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-04": {"ajax_action": "ttbp_assign_chapter_to_book", "conditions": [{"name": "ARGS:chapter_id", "type": "exists"}, {"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to reassign others\' chapters via ttbp_assign_chapter_to_book", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12129-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp-posts/v1/query(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-12129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12129", "description": "CubeWP Framework <=1.1.27 unauthenticated information exposure via /cubewp-posts/v1/query REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "cubewp-framework", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp-posts/v1/query-new(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-12129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12129", "description": "CubeWP Framework <=1.1.27 unauthenticated information exposure via /cubewp-posts/v1/query-new REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "cubewp-framework", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12137-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/importwp/v1/importer/\\\\d+/file(?:/|\\\\?|$)~"}, {"name": "ARGS:local_url", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|/etc/shadow|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|(?:\\\\.\\\\.[\\\\\\\\/]){2,})~i"}], "cve": "CVE-2025-12137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12137", "description": "Import WP <=2.14.16 authenticated (admin+) arbitrary file read via local_url parameter in REST API file_local import", "method": "POST", "mode": "block", "severity": 4.9, "slug": "jc-importer", "tags": ["arbitrary-file-read", "path-traversal", "rest-api"], "target": "plugin", "versions": "<=2.14.16"}, "RULE-CVE-2025-12138-01": {"ajax_action": "uimptr_import_single_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:php\\\\d?|phps|phtml|pht|phar)(?:[/?#%&\\"\'<>\\\\s]|%[0-9a-fA-F]{2}|$)~i"}], "cve": "CVE-2025-12138", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12138", "description": "URL Image Importer <=1.0.6 authenticated (Author+) arbitrary file upload via uimptr_import_single_url AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "url-image-importer", "tags": ["arbitrary-file-upload", "content-type-spoofing", "authenticated"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2025-12151-01": {"action": "admin_init", "conditions": [{"name": "ARGS:simple_folio_action", "type": "equals", "value": "add_simple_folio"}, {"name": "ARGS:portfolio_name", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12151", "description": "Simple Folio <=1.1.0 Stored XSS via portfolio_name parameter in add_simple_folio handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-12151-02": {"action": "admin_init", "conditions": [{"name": "ARGS:simple_folio_action", "type": "equals", "value": "remove_portfolio"}, {"name": "ARGS:id", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12151", "description": "Simple Folio <=1.1.0 Stored XSS via id parameter in remove_portfolio handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-12159-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|<|�*60;|�*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_raw_content shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:<|<|�*60;|�*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_raw_content shortcode in post_content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-03": {"ajax_action": "bt_bb_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|<|�*60;|�*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_get_html AJAX handler processing bt_bb_raw_content shortcode", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-04": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|<|�*60;|�*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_fe_get_html AJAX handler processing bt_bb_raw_content shortcode", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12160-01A": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01B": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[all]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[all] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01C": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[subscriber]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[subscriber] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01D": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[editor]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[editor] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01E": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[author]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[author] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01F": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[contributor]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[contributor] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01G": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[administrator]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[administrator] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12161-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~]+src=[\\"\']https?://[^\\"\']+\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:(?:%[0-9A-Fa-f]{2})|[?#\\"\'\\\\s>])~i"}], "cve": "CVE-2025-12161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12161", "description": "Smart Auto Upload Images <=1.2.0 arbitrary file upload via external URL with dangerous extension in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "smart-auto-upload-images", "tags": ["arbitrary-file-upload", "unsafe-file-type", "authenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-12161-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~]+src=[\\"\']https?://[^\\"\']+\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:(?:%[0-9A-Fa-f]{2})|[?#\\"\'\\\\s>])~i"}], "cve": "CVE-2025-12161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12161", "description": "Smart Auto Upload Images <=1.2.0 arbitrary file upload via external URL with dangerous extension in post content (REST API)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "smart-auto-upload-images", "tags": ["arbitrary-file-upload", "unsafe-file-type", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-12170-01": {"ajax_action": "checkbox_clean_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12170", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12170", "description": "Checkbox <=2.8.10 missing authorization on checkbox_clean_log AJAX endpoint allows unauthenticated log clearing", "mode": "block", "severity": 5.3, "slug": "checkbox", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=2.8.10"}, "RULE-CVE-2025-12181-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "cstu_update_post"}, {"name": "ARGS:image_url", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9s]?|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?#]|%00|$)~i"}], "cve": "CVE-2025-12181", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12181", "description": "ContentStudio <=1.3.7 authenticated arbitrary file upload via cstu_update_post image_url parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "contentstudio", "tags": ["arbitrary-file-upload", "unrestricted-upload", "authenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-12181-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "cstu_create_new_post"}, {"name": "ARGS:featured_image", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9s]?|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?#]|%00|$)~i"}], "cve": "CVE-2025-12181", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12181", "description": "ContentStudio <=1.3.7 authenticated arbitrary file upload via cstu_create_new_post featured_image parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "contentstudio", "tags": ["arbitrary-file-upload", "unrestricted-upload", "authenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-12192-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tribe_events/v2/[^/]{0,5}/sysinfo~"}], "cve": "CVE-2025-12192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12192", "description": "The Events Calendar <=6.15.9 unauthenticated information disclosure via sysinfo REST endpoint loose key comparison", "method": "GET", "mode": "block", "severity": 5.3, "slug": "the-events-calendar", "tags": ["information-disclosure", "type-juggling", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=6.15.9"}, "RULE-CVE-2025-12197-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/tec/v[0-9]+/events(?:\\\\?|$)|\\\\?rest_route=/tec/v[0-9]+/events(?:&|$))~i"}, {"name": "ARGS:/^(?:search|s)$/", "type": "regex", "value": "~(?i)(?:(?:sleep|pg_sleep|benchmark)\\\\s*\\\\(|waitfor\\\\s+(?:delay|nowait)\\\\b)~"}], "cve": "CVE-2025-12197", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12197", "description": "The Events Calendar 6.15.1.1-6.15.9 unauthenticated blind SQL injection via the search parameter on the /wp-json/tec/v*/events REST endpoint. CVE-2025-12197 is an incomplete-fix continuation of CVE-2025-9807; the Custom_Tables_Query.php sink remained exploitable through 6.15.9. Fixed completely in 6.15.10.", "method": "GET", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sqli", "blind-sqli", "rest-api", "unauthenticated", "incomplete-fix"], "target": "plugin", "versions": "<=6.15.9"}, "RULE-CVE-2025-1232-01": {"action": "init", "conditions": [{"name": "ARGS:_action", "type": "equals", "value": "submit-review"}, {"name": "ARGS:title", "type": "regex", "value": "~<(?:iframe|script|embed|object|form|meta|link|base)\\\\b|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-1232", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1232", "description": "Site Reviews <=7.2.4 unauthenticated stored XSS via review title on submit-review action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "site-reviews", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.2.4"}, "RULE-CVE-2025-1232-02": {"action": "init", "conditions": [{"name": "ARGS:_action", "type": "equals", "value": "submit-review"}, {"name": "ARGS:content", "type": "regex", "value": "~<(?:iframe|script|embed|object|form|meta|link|base)\\\\b|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-1232", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1232", "description": "Site Reviews <=7.2.4 unauthenticated stored XSS via review content on submit-review action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "site-reviews", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.2.4"}, "RULE-CVE-2025-12324-01": {"ajax_action": "tablepress_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\)\\\\s*;|]*>|on[a-zA-Z]{3,} *=~i"}], "cve": "CVE-2025-12371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12371", "description": "Nari Accountant <=1.0.12 Authenticated (Editor+) Stored XSS via account save action", "method": "POST", "mode": "block", "severity": 4.4, "slug": "nari-accountant", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.0.12"}, "RULE-CVE-2025-12371-02": {"ajax_action": "nari100", "conditions": [{"name": "ARGS:by", "type": "detectXSS"}], "cve": "CVE-2025-12371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12371", "description": "Nari Accountant <=1.0.12 Authenticated (Editor+) Reflected XSS via by parameter", "mode": "block", "severity": 4.4, "slug": "nari-accountant", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.0.12"}, "RULE-CVE-2025-12375-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/printful/v2/advanced-size-chart(/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "regex", "value": "~://(?:localhost|127\\\\.|10\\\\.|0\\\\.|169\\\\.254|172\\\\.(?:1[6-9]|2\\\\d|3[01])|192\\\\.168|\\\\[::1\\\\]|\\\\[0:|0\\\\.0\\\\.0\\\\.0)~i"}], "cve": "CVE-2025-12375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12375", "description": "Printful Integration for WooCommerce <=2.2.11 authenticated SSRF via advanced size chart REST API endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "printful-shipping-for-woocommerce", "tags": ["ssrf", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.2.11"}, "RULE-CVE-2025-12376-01": {"ajax_action": "fs_api_request", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "fs_api_request"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:https?:)?//~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12376", "description": "Icon List Block <=1.2.1 authenticated (Subscriber+) SSRF via fs_api_request AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "icon-list-block", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-12379-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:title_tag|title_tag_secondary)(?:\\\\\\\\?[\\"\']\\\\s*:\\\\s*\\\\\\\\?[\\"\'])(?!(?:h[1-6]|div|span|p)\\\\\\\\?[\\"\'])~i"}], "cve": "CVE-2025-12379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12379", "description": "Auxin Elements <=2.17.13 Stored XSS via Modern Heading widget title_tag/title_tag_secondary in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auxin-elements", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.17.13"}, "RULE-CVE-2025-12379-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:title_tag|title_tag_secondary)(?:\\\\\\\\?[\\"\']\\\\s*:\\\\s*\\\\\\\\?[\\"\'])(?!(?:h[1-6]|div|span|p)\\\\\\\\?[\\"\'])~i"}], "cve": "CVE-2025-12379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12379", "description": "Auxin Elements <=2.17.13 Stored XSS via Modern Heading widget title_tag/title_tag_secondary in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auxin-elements", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.17.13"}, "RULE-CVE-2025-12384-01": {"ajax_action": "bplde_save_document_library", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document creation/update via bplde_save_document_library AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-02": {"ajax_action": "bplde_get_all", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document listing via bplde_get_all AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-03": {"ajax_action": "bplde_get_single", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document read via bplde_get_single AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-04": {"ajax_action": "bplde_delete_document_library", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document deletion via bplde_delete_document_library AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12388-01": {"ajax_action": "bicbPipeChecker", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^https?://(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|0\\\\.|localhost|0x7f000001|2130706433|\\\\[::1\\\\]|\\\\[::ffff:|169\\\\.254\\\\.)|\\\\.internal[/:\\\\s]|^(?!https?://).+://)~i"}], "cve": "CVE-2025-12388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12388", "description": "B Carousel Block <=1.1.5 authenticated (Subscriber+) SSRF via bicbPipeChecker AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "b-carousel-block", "tags": ["ssrf", "missing-authorization", "server-side-request-forgery"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12392-01": {"action": "admin_post_nopriv_handle_optin_optout", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "handle_optin_optout"}], "cve": "CVE-2025-12392", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12392", "description": "TripleA Cryptocurrency Payment Gateway for WooCommerce <=2.0.25 missing authorization on handle_optin_optout allows unauthenticated tracking status update", "mode": "block", "severity": 5.3, "slug": "triplea-cryptocurrency-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.0.25"}, "RULE-CVE-2025-12392-02": {"action": "admin_post_handle_optin_optout", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "handle_optin_optout"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12392", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12392", "description": "TripleA Cryptocurrency Payment Gateway for WooCommerce <=2.0.25 missing authorization on handle_optin_optout allows low-privilege tracking status update", "mode": "block", "severity": 5.3, "slug": "triplea-cryptocurrency-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.25"}, "RULE-CVE-2025-12402-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedinresume.php"}, {"name": "ARGS:update_linkedinresumeSettings", "type": "exists"}, {"name": "ARGS:linkedinId", "type": "detectXSS"}], "cve": "CVE-2025-12402", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12402", "description": "LinkedIn Resume <=2.00 CSRF to Stored XSS via unsanitized linkedinId parameter in admin settings", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-resume", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.00"}, "RULE-CVE-2025-12402-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedinresume.php"}, {"name": "REQUEST_URI", "type": "regex", "value": "~]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|%3Cscript|%3E%3Cscript~i"}], "cve": "CVE-2025-12402", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12402", "description": "LinkedIn Resume <=2.00 Reflected XSS via unsanitized REQUEST_URI in admin page form action", "mode": "block", "severity": 6.1, "slug": "linkedin-resume", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.00"}, "RULE-CVE-2025-12406-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:access_key", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via access_key parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:honey_pot1", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via honey_pot1 parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:honey_pot2", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via honey_pot2 parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:output_to_all", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via output_to_all parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "REQUEST_URI", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=|%3c[a-z/!]|%6a%61%76%61%73%63%72%69%70%74~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 Reflected XSS via REQUEST_URI in settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12408-01": {"action": "init", "conditions": [{"name": "ARGS:em_ajax_action", "type": "equals", "value": "get_location"}, {"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-12408", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12408", "description": "Events Manager <=7.2.2.2 unauthenticated information exposure via get_location custom AJAX dispatcher", "mode": "block", "severity": 5.3, "slug": "events-manager", "tags": ["information-exposure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=7.2.2.2"}, "RULE-CVE-2025-12448-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "smartsupp"}, {"name": "ARGS:ssaction", "type": "equals", "value": "update"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12448", "description": "Smartsupp \\u2013 live chat, AI shopping assistant and chatbots <=3.9.1 authenticated (Subscriber+) unauthorized settings update via code parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "smartsupp-live-chat", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-12449-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/get_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on get_settings AJAX action exposes sensitive API keys to Subscriber+", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/save_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on save_settings AJAX action allows Subscriber+ to modify plugin settings and API keys", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/save_block_visibility"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on save_block_visibility AJAX action allows Subscriber+ to toggle block visibility", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-04": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/get_blocks_visibility"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on get_blocks_visibility AJAX action exposes block configuration to Subscriber+", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-05": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/fetch_posts"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on fetch_posts AJAX action allows Subscriber+ to enumerate posts", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12450-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^litespeed~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:|\\"|\'|on(?:error|load)\\\\s*=|<\\\\s*(?:script|img|svg)\\\\b)~i"}], "cve": "CVE-2025-12473", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12473", "description": "RomethemeKit For Elementor <=1.6.8 Reflected XSS via themebuilder parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rometheme-for-elementor", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.8"}, "RULE-CVE-2025-12475-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[blocksy_newsletter_subscribe\\\\s[^\\\\]]*(?:<[a-z]|\\\\bon\\\\w+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-12475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12475", "description": "Blocksy Companion <=2.1.14 Stored XSS via blocksy_newsletter_subscribe shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12475-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[blocksy_newsletter_subscribe\\\\s[^\\\\]]*(?:<[a-z]|\\\\bon\\\\w+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-12475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12475", "description": "Blocksy Companion <=2.1.14 Stored XSS via blocksy_newsletter_subscribe shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12482-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:%\'[\\\\s]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|HAVING|WHERE|SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)[\\\\s(]|/\\\\*[\\\\s\\\\S]*?\\\\*/)~i"}], "cve": "CVE-2025-12482", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12482", "description": "Amelia Booking <=1.2.35 unauthenticated SQL injection via search parameter in wpamelia_api AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ameliabooking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.2.35"}, "RULE-CVE-2025-12484-01": {"ajax_action": "rafflepress_lite_giveaway_api", "conditions": [{"name": "ARGS:entry_option", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:>|\\\\bon\\\\w+\\\\s*=)|javascript\\\\s*:|&#(?:60|x3[cC]);~i"}], "cve": "CVE-2025-12484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12484", "description": "RafflePress <=1.12.19 unauthenticated stored XSS via entry_option JSON blob in giveaway API", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rafflepress", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.12.19"}, "RULE-CVE-2025-12493-01": {"ajax_action": "woolentor_load_more_products", "conditions": [{"name": "ARGS:settings", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2e%2e(?:%2f|%5c)|\\\\.\\\\.%2f|\\\\.\\\\.%5c)~i"}], "cve": "CVE-2025-12493", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woolentor-addons", "target": "plugin", "versions": "<=3.2.5"}, "RULE-CVE-2025-12499-01": {"ajax_action": "grw_overview_ajax", "conditions": [{"name": "ARGS:place_id", "type": "detectXSS"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via place_id in grw_overview_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-02": {"ajax_action": "grw_feed_save_ajax", "conditions": [{"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via post_id in grw_feed_save_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-03": {"ajax_action": "grw_connect_google", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via unsanitized POST data in grw_connect_google", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-04": {"ajax_action": "grw_place_autocomplete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 reflected XSS via unsanitized POST data in grw_place_autocomplete", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-05": {"ajax_action": "grw_get_place", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via unsanitized Google Place data in grw_get_place", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12505-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wedocs/v1/settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12505", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12505", "description": "weDocs <=2.1.14 missing authorization on REST settings update allows Subscriber+ to modify global plugin settings", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wedocs", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12537-01": {"ajax_action": "eae_save_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12537", "description": "Addon Elements for Elementor <=1.14.3 Authenticated (Contributor+) Stored XSS via eae_save_config AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.14.3"}, "RULE-CVE-2025-12537-02": {"ajax_action": "eae_elements_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12537", "description": "Addon Elements for Elementor <=1.14.3 Authenticated (Contributor+) Stored XSS via eae_elements_save AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.14.3"}, "RULE-CVE-2025-12538-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "regex", "value": "~^iworks_fleet_(?:person|boat|result)$~"}, {"name": "ARGS", "type": "regex", "value": "~]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|resize|pointerdown)\\\\s*=|javascript\\\\s*:|]|]|]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12538", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12538", "description": "Fleet Manager <=2.5.1 Stored XSS via unsanitized post meta in person/boat/result custom post type admin columns", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fleet", "tags": ["xss", "stored-xss", "custom-post-type"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2025-12539-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-content[/\\\\\\\\]tnc-toolbox-config[/\\\\\\\\]~i"}], "cve": "CVE-2025-12539", "method": "GET", "mode": "block", "severity": 10.0, "slug": "tnc-toolbox", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-12540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-content/plugins/googleanalytics/credentials\\\\.json(?:\\\\?|$)~i"}], "cve": "CVE-2025-12540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12540", "description": "ShareThis Dashboard for Google Analytics <=3.2.4 unauthenticated sensitive credential exposure via credentials.json static file access", "mode": "block", "severity": 4.7, "slug": "googleanalytics", "tags": ["sensitive-data-exposure", "unauthenticated", "static-file-disclosure"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-12560-01": {"ajax_action": "b2s_get_full_content", "conditions": [{"name": "ARGS:post_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12560", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12560", "description": "Blog2Social <=8.6.0 authenticated (Subscriber+) blind SSRF via post_url in b2s_get_full_content AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "blog2social", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.6.0"}, "RULE-CVE-2025-12569-01": {"action": "init", "conditions": [{"name": "ARGS:redirect", "type": "regex", "value": "~^(?:https?:|//)~i"}], "cve": "CVE-2025-12569", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12569", "description": "WP Front User Submit / Front Editor <=4.9.5 open redirect via unvalidated redirect parameter in registration/login shortcode form submission", "method": "POST", "mode": "block", "severity": 4.7, "slug": "front-editor", "tags": ["open-redirect", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=4.9.5"}, "RULE-CVE-2025-12583-01": {"ajax_action": "neofix_sdl_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_add AJAX action allowing Subscriber+ stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-02": {"ajax_action": "neofix_sdl_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_edit AJAX action allowing Subscriber+ stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-03": {"ajax_action": "neofix_sdl_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_delete AJAX action allowing Subscriber+ unauthorized deletion", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-04": {"ajax_action": "neofix_sdl_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_restore AJAX action allowing Subscriber+ unauthorized restore", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-05": {"ajax_action": "neofix_sdl_get_file_url", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_get_file_url AJAX action allowing Subscriber+ information disclosure", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12621-01": {"ajax_action": "fr_refund_request", "conditions": [{"name": "ARGS:order_ID", "type": "exists"}, {"name": "ARGS:status", "type": "regex", "value": "~(?i)^\\\\s*(approved|refused)\\\\s*$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12621", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12621", "description": "Flexible Refund and Return Order for WooCommerce <=1.0.42 incorrect authorization on fr_refund_request AJAX action allows Contributor+ to approve/refuse refunds", "method": "POST", "mode": "block", "severity": 5.3, "slug": "flexible-refund-and-return-order-for-woocommerce", "tags": ["incorrect-authorization", "broken-access-control", "woocommerce"], "target": "plugin", "versions": "<=1.0.42"}, "RULE-CVE-2025-12628-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "validate_2fa"}, {"name": "ARGS:provider", "type": "regex", "value": "~^(?i)backup(?:_|%5[fF])codes$~"}, {"name": "ARGS:wp-2fa-backup-code", "type": "exists"}], "cve": "CVE-2025-12628", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12628", "description": "WP 2FA <=2.9.3 second factor bypass via brute-force of low-entropy backup codes on validate_2fa endpoint", "method": "POST", "mode": "block", "severity": 6.3, "slug": "wp-2fa", "tags": ["authentication-bypass", "insufficient-entropy", "brute-force"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-12630-01": {"ajax_action": "upload_am_get_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:option_name", "type": "exists"}], "cve": "CVE-2025-12630", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12630", "description": "Upload@AM <=1.0.0 arbitrary option disclosure via upload_am_get_option AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 4.9, "slug": "upload-am-file-hosting-vpn", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12630-02": {"ajax_action": "upload_am_update_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:option_name", "type": "exists"}, {"name": "ARGS:option_value", "type": "exists"}], "cve": "CVE-2025-12630", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12630", "description": "Upload@AM <=1.0.0 arbitrary option update via upload_am_update_option AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 4.9, "slug": "upload-am-file-hosting-vpn", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12633-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookit/v1/commerce/stripe/return(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12633", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12633", "description": "Bookit <=2.5.0 missing authorization on Stripe Connect return REST endpoint allows unauthenticated Stripe account linkage", "method": "GET", "mode": "block", "severity": 7.5, "slug": "bookit", "tags": ["missing-authorization", "unauthenticated", "rest-api", "stripe-connect"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1264-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/aioseoBrokenLinkChecker/v1/link-status-table(/|\\\\?|$)~"}, {"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2025-1264", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1264", "description": "Broken Link Checker by AIOSEO <=1.2.3 authenticated SQL injection via orderBy parameter on link-status-table REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-checker-seo", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-1264-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/aioseoBrokenLinkChecker/v1/links-table(/|\\\\?|$)~"}, {"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2025-1264", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1264", "description": "Broken Link Checker by AIOSEO <=1.2.3 authenticated SQL injection via orderBy parameter on links-table REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-checker-seo", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-12641-01": {"action": "init", "conditions": [{"name": "ARGS:wpas-do", "type": "equals", "value": "mr_activate_user"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12641", "description": "Awesome Support <=6.3.6 unauthenticated role demotion via wpas-do=mr_activate_user (GET)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "awesome-support", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=6.3.6"}, "RULE-CVE-2025-12641-02": {"action": "init", "conditions": [{"name": "ARGS:wpas-do", "type": "equals", "value": "mr_activate_user"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12641", "description": "Awesome Support <=6.3.6 unauthenticated role demotion via wpas-do=mr_activate_user (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "awesome-support", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=6.3.6"}, "RULE-CVE-2025-12643-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\[saphali_liqpay\\\\b[^\\\\]]*(?:<[a-z]|javascript\\\\s*:|on[a-z]+\\\\s*=)[^\\\\]]*\\\\]~"}], "cve": "CVE-2025-12643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12643", "description": "Saphali LiqPay for donate <=1.0.2 Stored XSS via [saphali_liqpay] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "saphali-liqpay-for-donate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12643-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~(?i)\\\\[saphali_liqpay\\\\b[^\\\\]]*(?:<[a-z]|javascript\\\\s*:|on[a-z]+\\\\s*=)[^\\\\]]*\\\\]~"}], "cve": "CVE-2025-12643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12643", "description": "Saphali LiqPay for donate <=1.0.2 Stored XSS via [saphali_liqpay] shortcode attributes in post_content param", "method": "POST", "mode": "block", "severity": 6.4, "slug": "saphali-liqpay-for-donate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12646-01": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:dayofyear", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-12646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12646", "description": "Community Events <=1.5.4 unauthenticated SQL injection via dayofyear parameter in frontend event list AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "community-events", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-12646-02": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:dayofyear", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-12646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12646", "description": "Community Events <=1.5.4 unauthenticated SQL injection via dayofyear parameter in frontend event list AJAX handler (GET variant)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "community-events", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-12649-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[sorttablepost[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2025-12649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12649", "description": "SortTable Post <=4.2 Stored XSS via sorttablepost shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sorttable-post", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2"}, "RULE-CVE-2025-12649-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sorttablepost[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2025-12649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12649", "description": "SortTable Post <=4.2 Stored XSS via sorttablepost shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sorttable-post", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2"}, "RULE-CVE-2025-12650-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[postlist\\\\b[^\\\\]]*class_name\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<[^>]*>|on\\\\w+\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12650", "description": "Simple Post Listing <=0.2 stored XSS via class_name shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-post-listing", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2"}, "RULE-CVE-2025-12650-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[postlist\\\\b[^\\\\]]*class_name\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<[^>]*>|on\\\\w+\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12650", "description": "Simple Post Listing <=0.2 stored XSS via class_name shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-post-listing", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.2"}, "RULE-CVE-2025-12654-01": {"ajax_action": "wpvividstg_check_filesystem_permissions_free", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:create_new_wp", "type": "equals", "value": "1"}, {"name": "ARGS:pwd", "type": "regex", "value": "~(^/|^[A-Za-z]:\\\\\\\\|\\\\.{2}|[/\\\\\\\\]{2,}|/etc/|^/var/|^/tmp/|/\\\\.|\\\\\\\\\\\\.)~i"}], "cve": "CVE-2025-12654", "method": "POST", "mode": "block", "severity": 2.7, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.120"}, "RULE-CVE-2025-12658-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[preload_progress_bar\\\\b[^\\\\]]*complete\\\\s*=[^\\\\]]*<[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12658", "description": "Preload Current Images <=1.3 authenticated stored XSS via [preload_progress_bar] shortcode complete attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "preload-current-images", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12658-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[preload_progress_bar\\\\b[^\\\\]]*complete\\\\s*=[^\\\\]]*<[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12658", "description": "Preload Current Images <=1.3 authenticated stored XSS via [preload_progress_bar] shortcode complete attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "preload-current-images", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12660-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(wallwisher|padlet)\\\\s[^\\\\]]*key\\\\s*=\\\\s*[\\"\'](?:[^\\\\]\\\\r\\\\n]|\\\\\\\\.)*?(<|>|on[a-z]+\\\\s*=|javascript:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12660", "description": "Padlet Shortcode <=1.3 Stored XSS via key attribute in [wallwisher]/[padlet] shortcode through post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wallwisher-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12660-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(wallwisher|padlet)\\\\s[^\\\\]]*key\\\\s*=\\\\s*[\\"\'](?:[^\\\\]\\\\r\\\\n]|\\\\\\\\.)*?(<|>|on[a-z]+\\\\s*=|javascript:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12660", "description": "Padlet Shortcode <=1.3 Stored XSS via key attribute in [wallwisher]/[padlet] shortcode through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wallwisher-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12661-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post[.]php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]pollcaster[^]]*height *=[^]]*(?:[<>]|on[a-zA-Z]+=|javascript *:)~i"}], "cve": "CVE-2025-12661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12661", "description": "Pollcaster Shortcode <=1.0 Stored XSS via shortcode height attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "pollcaster-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-12661-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|[?])rest_route=)/wp/v2/posts(/|[?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]pollcaster[^]]*height *=[^]]*(?:[<>]|on[a-zA-Z]+=|javascript *:)~i"}], "cve": "CVE-2025-12661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12661", "description": "Pollcaster Shortcode <=1.0 Stored XSS via shortcode height attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "pollcaster-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-12673-01": {"ajax_action": "flexqr_update_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:logo", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-02": {"ajax_action": "flexqr_save_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:logo", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-03": {"ajax_action": "flexqr_update_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:qr_image", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-04": {"ajax_action": "flexqr_save_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:qr_image", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12676-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kiotviet-sync/~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12676", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12676", "description": "KiotViet Sync <=1.8.5 unauthenticated authorization bypass via hardcoded password on REST API endpoints", "method": "POST", "mode": "block", "severity": 5.3, "slug": "kiotvietsync", "tags": ["hardcoded-credentials", "authorization-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2025-12677-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kiot(?:viet(?:sync)?)/(?:v[0-9]+/)?webhook(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12677", "description": "KiotViet Sync <=1.8.5 unauthenticated sensitive information exposure via webhook REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "kiotvietsync", "tags": ["information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2025-12681-01": {"ajax_action": "sce_get_comment", "conditions": [{"name": "ARGS:comment_id", "type": "exists"}], "cve": "CVE-2025-12681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12681", "description": "Simple Comment Editing <=3.1.0 unauthenticated sensitive information exposure via sce_get_comment AJAX action", "mode": "block", "severity": 5.3, "slug": "simple-comment-editing", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-12682-01": {"action": "init", "conditions": [{"name": "FILES:file_during_checkout", "type": "exists"}], "cve": "CVE-2025-12682", "method": "POST", "mode": "block", "severity": 9.8, "slug": "easy-upload-files-during-checkout", "target": "plugin", "versions": "<=2.9.8"}, "RULE-CVE-2025-12691-01": {"action": "admin_init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[photonic\\\\b[^\\\\]]*caption\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]]*)(?:]+\\\\bon)~i"}], "cve": "CVE-2025-12691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12691", "description": "Photonic Gallery & Lightbox <=3.21 stored XSS via [photonic] shortcode caption attribute in Classic Editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "photonic", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.21"}, "RULE-CVE-2025-12691-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[photonic\\\\b[^\\\\]]*caption\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]]*)(?:]+\\\\bon)~i"}], "cve": "CVE-2025-12691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12691", "description": "Photonic Gallery & Lightbox <=3.21 stored XSS via [photonic] shortcode caption attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "photonic", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.21"}, "RULE-CVE-2025-12707-01": {"ajax_action": "owt_lib_handler", "conditions": [{"name": "ARGS:bid", "type": "regex", "value": "~(?:VU5JT04=|U0VMRUNU|SU5TRVJU|VVBEQVRF|REVMRVRF|RFJPUA==|QU5E|T1I=|U0xFRVA=|RVhUUkFDVFZBTFVF|Q09OQ0FU|T1JERVIgQlk=|R1JPVVAgQlk=)~i"}], "cve": "CVE-2025-12707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12707", "description": "Library Management System <=3.2.1 unauthenticated SQL injection via bid parameter in owt_lib_handler AJAX handler", "mode": "block", "severity": 7.5, "slug": "library-management-system", "tags": ["sql-injection", "unauthenticated", "base64-encoded-parameter"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-12709-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/interact/v1/update_interaction(?:/|\\\\?|&|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:]*>|]|\\\\bon[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12709", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12709", "description": "Interactions <= 1.3.1 Authenticated (Contributor+) Stored XSS via event selectors in update_interaction REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "interactions", "tags": ["xss", "stored-xss", "rest-api", "missing-capability"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-12718-01": {"ajax_action": "qcf_validate_form", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~[\\\\r\\\\n]~"}], "cve": "CVE-2025-12718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12718", "description": "Quick Contact Form <=8.2.6 unauthenticated open mail relay via email header injection in qcf_validate_form AJAX handler", "method": "POST", "mode": "block", "severity": 5.8, "slug": "quick-contact-form", "tags": ["email-header-injection", "open-mail-relay", "unauthenticated", "improper-input-validation"], "target": "plugin", "versions": "<=8.2.6"}, "RULE-CVE-2025-12721-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fflcockpit/v1/server_status(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12721", "description": "g-FFL Cockpit <=1.7.1 unauthenticated information disclosure via /fflcockpit/v1/server_status REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "g-ffl-cockpit", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-12746-01": {"action": "init", "conditions": [{"name": "ARGS:search", "type": "detectXSS"}], "cve": "CVE-2025-12746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12746", "description": "Tainacan <=1.0.0 reflected XSS via search parameter in front-end template", "method": "GET", "mode": "block", "severity": 6.1, "slug": "tainacan", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12746-02": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(\\\\\\"|\')\\\\s*on\\\\w+\\\\s*=|<(script|svg|iframe|img)[\\\\s/>]|javascript\\\\s*:~i"}], "cve": "CVE-2025-12746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12746", "description": "Tainacan <=1.0.0 reflected XSS via arbitrary GET parameters reflected into hidden form fields", "method": "GET", "mode": "block", "severity": 6.1, "slug": "tainacan", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12747-01": {"action": "template_redirect", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?i)^/wp-content/uploads/tainacan-items/\\\\d+/_x_\\\\d+/~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-12747", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12747", "description": "Tainacan <=1.0.0 unauthenticated information exposure via direct access to private files in tainacan-items uploads directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "tainacan", "tags": ["information-exposure", "unauthenticated", "direct-file-access"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12754-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[geopost\\\\b[^\\\\]]*(?:height|width)\\\\s*=\\\\s*[^\\\\]]*(?:\'\\";&|`]~"}], "cve": "CVE-2025-12787", "method": "POST", "mode": "block", "severity": 5.3, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12800-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "su_generator_preview"}, {"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[su_csv_table[^\\\\]]*url\\\\s*=~i"}], "cve": "CVE-2025-12800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12800", "description": "Shortcodes Ultimate <=7.4.5 Server-Side Request Forgery via su_csv_table shortcode in AJAX preview", "method": "POST", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "tags": ["ssrf", "server-side-request-forgery", "shortcode"], "target": "plugin", "versions": "<=7.4.5"}, "RULE-CVE-2025-12803-01": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_tabs\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12803", "description": "Bold Page Builder <=5.5.1 Stored XSS via bt_bb_tabs shortcode event handler injection in bt_bb_fe_save AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.5.1"}, "RULE-CVE-2025-12803-02": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_tabs\\\\b[^\\\\]]*]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe|embed|object|details|math)[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12830", "description": "Better Elementor Addons <=1.5.5 Stored XSS via Slider widget title_html_tag and title fields in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "better-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.5.5"}, "RULE-CVE-2025-12836-01": {"action": "admin_init", "conditions": [{"name": "ARGS:vkjp_description", "type": "regex", "value": "~<[a-zA-Z][^>]*\\\\s(?:on\\\\w+)\\\\s*=~i"}], "cve": "CVE-2025-12836", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12836", "description": "VK Google Job Posting Manager <=1.2.23 Stored XSS via vkjp_description event-handler injection", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vk-google-job-posting-manager", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-12836-02": {"action": "init", "conditions": [{"name": "ARGS:vkjp_description", "type": "regex", "value": "~<(?:script[\\\\s>]|/script>|iframe[\\\\s>]|svg[\\\\s/>]|embed[\\\\s>]|object[\\\\s>]|scrscriptipt\\\\b)|\\\\b(?:href|src|xlink:href)\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-12836", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12836", "description": "VK Google Job Posting Manager <=1.2.23 Stored XSS via vkjp_description dangerous element injection", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vk-google-job-posting-manager", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-12837-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:waf_probe", "type": "regex", "value": "~]|<[^>]+\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12837", "description": "aThemes Addons for Elementor Lite <=1.1.5 Stored XSS via Call To Action widget settings in REST API content save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "athemes-addons-for-elementor-lite", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12837-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~]|<[^>]+\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12837", "description": "aThemes Addons for Elementor Lite <=1.1.5 Stored XSS via Call To Action widget settings in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "athemes-addons-for-elementor-lite", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12841-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/bookit/v1/commerce/stripe/return(?:/|\\\\?|$)~"}, {"name": "ARGS:stripe", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12841", "description": "Bookit <=2.5.0 unauthenticated Stripe settings update via REST API /commerce/stripe/return endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "bookit", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-12841-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookit/v1/commerce/stripe/return(?:/|$)~"}, {"name": "ARGS:stripe", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12841", "description": "Bookit <=2.5.0 unauthenticated Stripe settings update via REST API /commerce/stripe/return endpoint (rest_route fallback)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "bookit", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-12844-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleTranscribeAudio(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleTranscribeAudio REST endpoint", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleVisionQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleVisionQuery REST endpoint", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleTextQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleTextQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleFastTextQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleFastTextQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleJsonQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleJsonQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12845-01": {"ajax_action": "get_tables_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12845", "description": "Tablesome <=1.2.1 missing authorization on get_tables_data AJAX action allows subscriber+ to retrieve sensitive table data", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-12851-01": {"action": "init", "conditions": [{"name": "ARGS:controller", "type": "regex", "value": "~(?:[\\\\.\\\\\\\\/-]|%2[dDeEfF]|%5[cC])~"}], "cve": "CVE-2025-12851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12851", "description": "My auctions allegro <=3.6.32 unauthenticated Local File Inclusion via controller parameter on init hook", "mode": "block", "severity": 8.1, "slug": "my-auctions-allegro-free-edition", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=3.6.32"}, "RULE-CVE-2025-1287-01": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:text_days|text_hours|text_minutes|text_seconds|cpybtntext|lanugaetext|copiedbtntext|cpyerrbtntext|dwnldBtnText|nav_dots_tooltips|fp-slideid)[^}]{0,200}(?:]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|mouse(?:over|out|enter|leave))\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe|object|embed|math|details|body|marquee)[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12904", "description": "H5PxAPIkatchu <= 0.4.17 Unauthenticated Stored XSS via insert_data AJAX endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "h5pxapikatchu", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=0.4.17"}, "RULE-CVE-2025-1291-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-1291-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-1291-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-12934-01": {"ajax_action": "fl_builder_duplicate_wpml_layout", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}, {"name": "ARGS:original_post_id", "type": "exists"}], "cve": "CVE-2025-12934", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12934", "description": "Beaver Builder <= 2.9.4.1 missing authorization on duplicate_wpml_layout AJAX handler allows Subscriber+ arbitrary post update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "arbitrary-post-update"], "target": "plugin", "versions": "<=2.9.4.1"}, "RULE-CVE-2025-12935-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluentcrm_content\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|]+onerror)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12935", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12935", "description": "FluentCRM <=2.9.84 Stored XSS via [fluentcrm_content] shortcode attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-crm", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.9.84"}, "RULE-CVE-2025-12935-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluentcrm_content\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|]+onerror)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12935", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12935", "description": "FluentCRM <=2.9.84 Stored XSS via [fluentcrm_content] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-crm", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.9.84"}, "RULE-CVE-2025-12955-01": {"ajax_action": "pisol_live_orders", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12955", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12955", "description": "Live Sales Notification for WooCommerce <=2.3.39 missing authorization on pisol_live_orders AJAX handler exposing customer order data", "mode": "block", "severity": 7.5, "slug": "live-sales-notifications-for-woocommerce", "tags": ["missing-authorization", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=2.3.39"}, "RULE-CVE-2025-12960-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[csv\\\\b[^\\\\]]*\\\\bhref\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/etc/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12960", "description": "Simple CSV Table <=1.0.1 directory traversal via [csv href] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-csv-table", "tags": ["path-traversal", "local-file-inclusion", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12960-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[csv\\\\b[^\\\\]]*\\\\bhref\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/etc/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12960", "description": "Simple CSV Table <=1.0.1 directory traversal via [csv href] shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-csv-table", "tags": ["path-traversal", "local-file-inclusion", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12963-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lazytasks/api/v1/user/role/edit(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12963", "method": "POST", "mode": "block", "severity": 9.8, "slug": "lazytasks-project-task-management", "target": "plugin", "versions": "<=1.2.29"}, "RULE-CVE-2025-12964-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdpr_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdpr_title_tag in Pricing Table Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdpr_subtitle_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdpr_subtitle_tag in Pricing Table Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdal_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdal_title_tag in Products Awesome List Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-04": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpcar_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpcar_title_tag in Products Carousel Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-05": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpdeg_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpdeg_title_tag in Products Grid/Tab Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-06": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpdel_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpdel_title_tag in Products List Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12973-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "s2b_store_chatbot_upload"}, {"name": "FILES:s2baia_chatbot_config_database", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12973", "description": "S2B AI Assistant <=1.7.8 arbitrary file upload via s2b_store_chatbot_upload admin-post action", "method": "POST", "mode": "block", "severity": 7.2, "slug": "s2b-ai-assistant", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=1.7.8"}, "RULE-CVE-2025-12984-01": {"action": "admin_init", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-12984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12984", "description": "Advanced Ads <=2.0.15 authenticated (admin+) SQL injection via order parameter in placement list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "advanced-ads", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.0.15"}, "RULE-CVE-2025-13006-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/fsd(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/fsd REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/responses(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/responses REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/responses/[0-9-]+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/responses/{id} REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/surveys(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/surveys REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/surveys/survey_id=[0-9-]+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/surveys/survey_id={id} REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13031-01": {"action": "admin_post_save_wpematico_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Stored XSS via unsanitized settings output in settings_form()", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-02": {"action": "admin_post_wpematico_campaign_preview_item", "conditions": [{"name": "ARGS:return_url", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:(?:text/html|application/xhtml)|on\\\\w+\\\\s*=|]|<[^>]+[\\\\s/]+on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13048", "description": "Official StatCounter Plugin <=2.1.0 Authenticated (Contributor+) Stored XSS via Nickname", "method": "POST", "mode": "block", "severity": 6.4, "slug": "official-statcounter-plugin-for-wordpress", "tags": ["xss", "stored-xss", "missing-output-escaping"], "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2025-13054-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-1307-01": {"ajax_action": "newscrunch_install_activate_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-1307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1307", "description": "Newscrunch <=1.8.4 missing authorization on newscrunch_install_activate_plugin allows subscriber+ arbitrary plugin installation and RCE", "mode": "block", "severity": 9.8, "slug": "newscrunch", "tags": ["missing-authorization", "arbitrary-file-upload", "remote-code-execution"], "target": "theme", "versions": "<=1.8.4"}, "RULE-CVE-2025-13072-01": {"action": "init", "conditions": [{"name": "ARGS:utm_source", "type": "detectXSS"}], "cve": "CVE-2025-13072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13072", "description": "HandL UTM Grabber <=2.8 Reflected XSS via utm_source query parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "handl-utm-grabber", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.8"}, "RULE-CVE-2025-13073-01": {"ajax_action": "handl_get_zapier_log", "conditions": [{"name": "ARGS:handl_landing_page", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13073", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13073", "description": "HandL UTM Grabber <=2.8 reflected XSS via handl_landing_page in handl_get_zapier_log AJAX handler", "mode": "block", "severity": 7.1, "slug": "handl-utm-grabber", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<2.8.1"}, "RULE-CVE-2025-1309-01": {"ajax_action": "uip_save_form_as_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1309", "description": "UiPress Lite <=3.5.04 missing authorization on uip_save_form_as_option AJAX handler allows arbitrary options update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "uipress-lite", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-options-update"], "target": "plugin", "versions": "<=3.5.04"}, "RULE-CVE-2025-1310-01": {"action": "parse_request", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~job-postings-get-file/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|%252e%252e%255c)~i"}], "cve": "CVE-2025-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1310", "description": "Job Postings <=2.7.11 authenticated arbitrary file read via path traversal in job_postings_get_file (rewrite rule path)", "mode": "block", "severity": 6.5, "slug": "job-postings", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-1310-02": {"action": "parse_request", "conditions": [{"name": "ARGS:job_postings_get_file", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]|\\\\.\\\\.%2f|\\\\.\\\\.%5c|\\\\.\\\\.%252f|\\\\.\\\\.%255c|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|%252e%252e%255c|^/)~i"}], "cve": "CVE-2025-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1310", "description": "Job Postings <=2.7.11 authenticated arbitrary file read via path traversal in job_postings_get_file (query string path)", "mode": "block", "severity": 6.5, "slug": "job-postings", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-1311-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcfmmp/v1/deliveries/[^/]*[^0-9/][^/]*~i"}], "cve": "CVE-2025-1311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1311", "description": "WCFM Marketplace REST API <=1.6.2 authenticated SQL injection via non-numeric id path segment in /wcfmmp/v1/deliveries/{id}", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wcfm-marketplace-rest-api", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.6.2"}, "RULE-CVE-2025-1312-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "ultimate-blocks/call-to-action"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"buttonTextColor\\"\\\\s*:\\\\s*\\"[^\\"]*[<>][^\\"]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1312", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1312", "description": "Ultimate Blocks <=3.2.7 Stored XSS via unescaped buttonTextColor attribute in Call-to-Action block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1312-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "ultimate-blocks/call-to-action"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\"buttonTextColor\\"\\\\s*:\\\\s*\\"[^\\"]*[<>][^\\"]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1312", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1312", "description": "Ultimate Blocks <=3.2.7 Stored XSS via unescaped buttonTextColor attribute in Call-to-Action block (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-13146-01": {"ajax_action": "wpcf7dtx", "conditions": [{"name": "ARGS:shortcodes[/.+/][value]", "type": "regex", "value": "~(?:[\\\\[\\\\]]|[a-zA-Z_][\\\\w-]{0,40}\\\\s*=\\\\s*[\\"\'])~"}], "cve": "CVE-2025-13146", "description": "Contact Form 7 - Dynamic Text Extension <=5.0.7 unauthenticated arbitrary shortcode execution via wpcf7dtx AJAX handler", "mode": "block", "slug": "contact-form-7-dynamic-text-extension", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2025-13153-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "logosliderwp"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:autofocus|on[a-z]+)\\\\s*=|<\\\\s*(?:script|svg|iframe|img|object|embed|math|details|body|video|audio|input|textarea|select|button|form|marquee|isindex|xmp)\\\\b)~i"}], "cve": "CVE-2025-13153", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13153", "description": "Logo Slider <4.9.0 Contributor+ Stored XSS via unescaped slider options on logosliderwp post type save", "method": "POST", "mode": "block", "severity": 6.1, "slug": "logo-slider-wp", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<4.9.0"}, "RULE-CVE-2025-13153-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "lgx_lsp_shortcodes"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:autofocus|on[a-z]+)\\\\s*=|<\\\\s*(?:script|svg|iframe|img|object|embed|math|details|body|video|audio|input|textarea|select|button|form|marquee|isindex|xmp)\\\\b)~i"}], "cve": "CVE-2025-13153", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13153", "description": "Logo Slider <4.9.0 Contributor+ Stored XSS via unescaped slider options on lgx_lsp_shortcodes post type save", "method": "POST", "mode": "block", "severity": 6.1, "slug": "logo-slider-wp", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<4.9.0"}, "RULE-CVE-2025-13156-01": {"action": "rest_api_init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|aspx?|jspx?|cfm|user\\\\.ini)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-13156", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13156", "description": "VitePos Lite <=3.3.0 authenticated arbitrary file upload via REST API leading to RCE", "method": "POST", "mode": "block", "severity": 8.8, "slug": "vitepos-lite", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.3.0"}, "RULE-CVE-2025-13206-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_first", "type": "detectXSS"}], "cve": "CVE-2025-13206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13206", "description": "GiveWP <= 4.13.0 stored XSS via donor first name in donation form submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.13.0"}, "RULE-CVE-2025-13206-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_last", "type": "detectXSS"}], "cve": "CVE-2025-13206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13206", "description": "GiveWP <= 4.13.0 stored XSS via donor last name in donation form submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.13.0"}, "RULE-CVE-2025-13217-01": {"ajax_action": "um_update_profile_full", "conditions": [{"name": "ARGS:youtube_video", "type": "exists"}, {"name": "ARGS:youtube_video", "type": "regex", "value": "~(?:<[a-z/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13217", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13217", "description": "Ultimate Member <=2.11.0 Stored XSS via youtube_video profile field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-member", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.11.0"}, "RULE-CVE-2025-1324-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[public-form"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[public-form\\\\s[^\\\\]]*(?:\\"\']|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13311", "description": "Just Highlight <=1.0.3 authenticated (Administrator+) stored XSS via sigijh_color_select setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "just-highlight", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-13314-01": {"ajax_action": "filter_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13314", "description": "Filter Plus <=1.1.6 missing authorization on filter_save_settings AJAX action allows unauthenticated settings modification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "filter-plus", "tags": ["missing-authorization", "settings-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-13314-02": {"ajax_action": "add_filter_options", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13314", "description": "Filter Plus <=1.1.6 missing authorization on add_filter_options AJAX action allows unauthenticated post creation and meta write", "method": "POST", "mode": "block", "severity": 5.3, "slug": "filter-plus", "tags": ["missing-authorization", "arbitrary-post-creation", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-13320-01": {"action": "admin_init", "conditions": [{"name": "ARGS:account[user_avatar][path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|[/\\\\\\\\]etc[/\\\\\\\\]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-13320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13320", "description": "WP User Manager <=2.9.12 arbitrary file deletion via path traversal in avatar path parameter during profile update", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-user-manager", "tags": ["arbitrary-file-deletion", "path-traversal", "external-file-control"], "target": "plugin", "versions": "<=2.9.12"}, "RULE-CVE-2025-13329-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/add-image-data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:fileName", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2025-13329", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-uploader-for-woocommerce", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-13334-01": {"ajax_action": "blaze_demo_importer_install_demo", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:reset", "type": "equals", "value": "true"}], "cve": "CVE-2025-13334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13334", "description": "Blaze Demo Importer <=1.0.13 missing authorization on blaze_demo_importer_install_demo AJAX action allows subscriber+ site reset", "method": "POST", "mode": "block", "severity": 8.1, "slug": "blaze-demo-importer", "tags": ["missing-authorization", "broken-access-control", "database-reset"], "target": "plugin", "versions": "<=1.0.13"}, "RULE-CVE-2025-13342-02": {"ajax_action": "frontend_admin/forms/update_field", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13342", "description": "Frontend Admin (ACF Frontend Form Element) <=3.28.20 unauthenticated arbitrary options update via update_field AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=3.28.20"}, "RULE-CVE-2025-13358-01": {"ajax_action": "ccpcaCreatePage", "conditions": [{"type": "missing_capability", "value": "publish_pages"}], "cve": "CVE-2025-13358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13358", "description": "CodeConfig Accessibility <=1.0.0 missing authorization on ccpcaCreatePage AJAX action allows Subscriber+ arbitrary page creation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "codeconfig-accessibility", "tags": ["missing-authorization", "broken-access-control", "arbitrary-content-creation"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-13359-01": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_orderby", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via existing_terms_orderby in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-02": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_order", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via existing_terms_order in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-03": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_maximum_terms", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 SQL injection via existing_terms_maximum_terms in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-04": {"ajax_action": "simpletags", "conditions": [{"name": "ARGS:suggest_local_terms_orderby", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via suggest_local_terms_orderby in simpletags AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-05": {"ajax_action": "simpletags", "conditions": [{"name": "ARGS:suggest_local_terms_order", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via suggest_local_terms_order in simpletags AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13364-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[put_wpgm\\\\s[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3[Cc]script|%6[Ff]n(?:error|load|mouseover|click))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13364", "description": "WP Google Map Plugin <=4.8.7 stored XSS via put_wpgm shortcode attributes in post content (classic editor)", "mode": "block", "severity": 6.4, "slug": "wp-google-map-plugin", "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-13364-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[put_wpgm\\\\s[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3[Cc]script|%6[Ff]n(?:error|load|mouseover|click))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13364", "description": "WP Google Map Plugin <=4.8.7 stored XSS via put_wpgm shortcode attributes in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "wp-google-map-plugin", "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-13367-01": {"action": "init", "conditions": [{"name": "ARGS:username", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via username GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13367-02": {"action": "init", "conditions": [{"name": "ARGS:info", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via info GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13367-03": {"action": "init", "conditions": [{"name": "ARGS:transaction_id", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via transaction_id GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:money_spent_from", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via money_spent_from filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:money_spent_to", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via money_spent_to filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:registered_from", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via registered_from filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:registered_to", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via registered_to filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13370-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pl-add"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\())~i"}], "cve": "CVE-2025-13370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13370", "description": "ProjectList <=0.3.0 authenticated (Editor+) time-based SQL injection via id parameter on pl-add admin page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "projectlist", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13370-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pl-add"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\())~i"}], "cve": "CVE-2025-13370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13370", "description": "ProjectList <=0.3.0 authenticated (Editor+) SQL injection via id parameter on pl-add admin page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "projectlist", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13376-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "projectlist-add"}, {"name": "FILES:pl_image", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13376", "description": "ProjectList <=0.3.0 authenticated arbitrary file upload via pl_image on Add Project page", "method": "POST", "mode": "block", "severity": 7.2, "slug": "projectlist", "tags": ["arbitrary-file-upload", "file-upload", "authenticated"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13383-01": {"action": "init", "conditions": [{"name": "ARGS:jbbrd_save_search", "type": "equals", "value": "1"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|iframe|object|embed|svg|math|img|video|audio|body|details|marquee|isindex|form|input|button|select|textarea|keygen|meta|link|base|style)[\\\\s/>]|\\\\bon(?:error|load|focus|click|mouse(?:over|out|enter)|change|blur|submit|reset|key(?:up|down|press)|contextmenu|dblclick|drag|drop|input|invalid|scroll|wheel|animat(?:ion|ed)|transition)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13383", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13383", "description": "Job Board by BestWebSoft <=1.2.1 stored XSS via CSRF through unsanitized $_GET array storage in save-search", "method": "GET", "mode": "block", "severity": 6.1, "slug": "job-board", "tags": ["xss", "stored-xss", "csrf", "shortcode"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-13387-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/checkout|[?&]wc-ajax=checkout)~i"}, {"name": "ARGS:billing_first_name", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13387", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13387", "description": "Kadence WooCommerce Email Designer <=1.5.17 unauthenticated stored XSS via billing_first_name at checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "kadence-woocommerce-email-designer", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.17"}, "RULE-CVE-2025-13387-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/checkout|[?&]wc-ajax=checkout)~i"}, {"name": "ARGS:billing_last_name", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13387", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13387", "description": "Kadence WooCommerce Email Designer <=1.5.17 unauthenticated stored XSS via billing_last_name at checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "kadence-woocommerce-email-designer", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.17"}, "RULE-CVE-2025-13403-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "employee-spotlight_check_optin"}, {"name": "ARGS:employee-spotlight_optin", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13403", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13403", "description": "Employee Spotlight <=5.1.3 missing authorization on tracking opt-in via admin_post handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "employee-spotlight", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-13403-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "employee-spotlight_check_optin"}, {"name": "ARGS:employee-spotlight_no_optin", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13403", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13403", "description": "Employee Spotlight <=5.1.3 missing authorization on tracking opt-out via admin_post handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "employee-spotlight", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-13409-01": {"ajax_action": "fv_get_analytics_data", "conditions": [{"name": "ARGS:params", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP)\\\\s|\\\\(\\\\s*SELECT\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13409", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13409", "description": "Form Vibes <=1.4.13 authenticated SQL injection via params parameter in fv_get_analytics_data AJAX handler", "mode": "block", "severity": 4.9, "slug": "form-vibes", "tags": ["sql-injection", "authenticated", "admin-plus"], "target": "plugin", "versions": "<=1.4.13"}, "RULE-CVE-2025-13414-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:cdash_export_businesses", "type": "exists"}], "cve": "CVE-2025-13414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13414", "description": "Chamber Dashboard Business Directory <= 3.3.11 unauthenticated business information export via cdash_watch_for_export", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chamber-dashboard-business-directory", "tags": ["missing-authorization", "unauthenticated", "data-export"], "target": "plugin", "versions": "<=3.3.11"}, "RULE-CVE-2025-13414-02": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:cdash_export", "type": "exists"}], "cve": "CVE-2025-13414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13414", "description": "Chamber Dashboard Business Directory <= 3.3.11 unauthenticated business information export via cdash_watch_for_export (alt trigger cdash_export)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chamber-dashboard-business-directory", "tags": ["missing-authorization", "unauthenticated", "data-export"], "target": "plugin", "versions": "<=3.3.11"}, "RULE-CVE-2025-13419-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bfe/v1/revert(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-13419", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13419", "description": "Front Editor <=5.0.0 unauthenticated arbitrary media deletion via /bfe/v1/revert REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "front-editor", "tags": ["missing-authorization", "unauthenticated", "rest-api", "idor"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-13431-01": {"ajax_action": "slimstat_load_report", "conditions": [{"name": "ARGS:args", "type": "regex", "value": "~(?i)(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SELECT\\\\s+.*\\\\bFROM\\\\b|INSERT\\\\s+INTO\\\\b|DELETE\\\\s+FROM\\\\b|UPDATE\\\\s+.*\\\\bSET\\\\b|DROP\\\\s+TABLE\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|[\\\\x27\\"]\\\\s*(?:OR|AND)\\\\s+[\\\\x27\\"\\\\d]|[\\\\x27\\"]\\\\s*;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:ORDER|GROUP)\\\\s+BY\\\\s+\\\\d+)~"}], "cve": "CVE-2025-13431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13431", "description": "SlimStat Analytics <=5.3.1 authenticated SQL injection via args parameter in slimstat_load_report AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-13431-02": {"ajax_action": "slimstat_fetch_chart_data", "conditions": [{"name": "ARGS:args", "type": "regex", "value": "~(?i)(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SELECT\\\\s+.*\\\\bFROM\\\\b|INSERT\\\\s+INTO\\\\b|DELETE\\\\s+FROM\\\\b|UPDATE\\\\s+.*\\\\bSET\\\\b|DROP\\\\s+TABLE\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|[\\\\x27\\"]\\\\s*(?:OR|AND)\\\\s+[\\\\x27\\"\\\\d]|[\\\\x27\\"]\\\\s*;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:ORDER|GROUP)\\\\s+BY\\\\s+\\\\d+)~"}], "cve": "CVE-2025-13431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13431", "description": "SlimStat Analytics <=5.3.1 authenticated SQL injection via args parameter in slimstat_fetch_chart_data AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-13440-01": {"action": "admin_post_premmerce_delete_wishlist", "conditions": [{"name": "ARGS:wishlist", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13440", "description": "Premmerce Wishlist for WooCommerce <=1.1.10 missing authorization on deleteWishlist via admin_post action", "method": "GET", "mode": "block", "severity": 5.3, "slug": "premmerce-woocommerce-wishlist", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.1.10"}, "RULE-CVE-2025-13448-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:demo|ci-demo)\\\\s+[^\\\\]]*element\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]\\"\']*)(?:script\\\\b|img\\\\b|svg\\\\b|iframe\\\\b|object\\\\b|embed\\\\b|body\\\\b|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13448", "description": "CSSIgniter Shortcodes <=2.4.1 Stored XSS via \'element\' shortcode attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cssigniter-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-13448-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:demo|ci-demo)\\\\s+[^\\\\]]*element\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]\\"\']*)(?:script\\\\b|img\\\\b|svg\\\\b|iframe\\\\b|object\\\\b|embed\\\\b|body\\\\b|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13448", "description": "CSSIgniter Shortcodes <=2.4.1 Stored XSS via \'element\' shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cssigniter-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-13463-01": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|focusin|pointerenter|animationend)\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bsrcdoc\\\\s*=~i"}], "cve": "CVE-2025-13463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13463", "description": "Bold Page Builder <=5.5.3 Stored DOM-based XSS via bt_bb_fe_get_html AJAX handler content parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=5.5.3"}, "RULE-CVE-2025-13463-02": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|focusin|pointerenter|animationend)\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bsrcdoc\\\\s*=~i"}], "cve": "CVE-2025-13463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13463", "description": "Bold Page Builder <=5.5.3 Stored DOM-based XSS via bt_bb_fe_save AJAX handler content parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=5.5.3"}, "RULE-CVE-2025-13486-01": {"ajax_action": "acfe/form/render_form_ajax", "conditions": [{"name": "ARGS:_acf_form", "type": "regex", "value": "~(?i)\\\\b(system|exec|passthru|shell_exec|popen|proc_open|file_put_contents|assert|eval)\\\\b~i"}], "cve": "CVE-2025-13486", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": ">=0.9.0.5 <=0.9.1.1"}, "RULE-CVE-2025-13497-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[recras-booking[^\\\\]]*recrasname\\\\s*=\\\\s*(?:\\"[^\\"]*[\');}<>][^\\"]*\\"|\'[^\']*[\\");}<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13497", "description": "Recras <=6.4.1 Stored XSS via recras-booking shortcode recrasname attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recras", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.4.1"}, "RULE-CVE-2025-13497-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[recras-booking[^\\\\]]*recrasname\\\\s*=\\\\s*(?:\\"[^\\"]*[\');}<>][^\\"]*\\"|\'[^\']*[\\");}<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13497", "description": "Recras <=6.4.1 Stored XSS via recras-booking shortcode recrasname attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recras", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.4.1"}, "RULE-CVE-2025-13516-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-content/uploads/suremails/attachments/[^/]+\\\\.(?:php\\\\d*|phtml|phar|phps|pht|phpt|inc)(?:\\\\?|$)~i"}], "cve": "CVE-2025-13516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13516", "description": "SureMail <=1.9.0 unauthenticated RCE via direct access to uploaded PHP files in suremails attachments directory", "mode": "block", "severity": 8.1, "slug": "suremails", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "dangerous-file-type"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-13525-01": {"action": "init", "conditions": [{"name": "ARGS:order_by", "type": "detectXSS"}], "cve": "CVE-2025-13525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13525", "description": "WP Directory Kit <=1.4.5 Reflected Cross-Site Scripting via order_by parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wpdirectorykit", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2025-13534-01": {"ajax_action": "eh_crm_edit_agent", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:user_id", "type": "regex", "value": "~.+~"}, {"name": "ARGS:rights", "type": "regex", "value": "~.+~"}], "cve": "CVE-2025-13534", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elex-helpdesk-customer-support-ticket-system", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2025-13537-01": {"ajax_action": "dslc-ajax-save-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-save-composer AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-02": {"ajax_action": "dslc-ajax-save-draft-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-save-draft-composer AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-03": {"ajax_action": "dslc-ajax-import-template", "conditions": [{"name": "ARGS:dslc_template_code", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-import-template AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-04": {"ajax_action": "dslc-ajax-import-modules-section", "conditions": [{"name": "ARGS:dslc_modules_section_code", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-import-modules-section AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13592-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~change-ad__content~"}], "cve": "CVE-2025-13592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13592", "description": "Advanced Ads <=2.0.14 authenticated (Editor+) RCE via change-ad__content shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-ads", "tags": ["code-injection", "remote-code-execution", "shortcode"], "target": "plugin", "versions": "<=2.0.14"}, "RULE-CVE-2025-13592-02": {"ajax_action": "advads-ad-injection-content", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~change-ad__content\\\\s*=~i"}], "cve": "CVE-2025-13592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13592", "description": "Advanced Ads <=2.0.14 authenticated (Editor+) RCE via change-ad__content shortcode attribute in AJAX injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-ads", "tags": ["code-injection", "remote-code-execution", "shortcode", "ajax"], "target": "plugin", "versions": "<=2.0.14"}, "RULE-CVE-2025-13604-03": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:\\\\s*(?:text/html|application/xhtml))~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via javascript:/data: URI scheme in GET query parameter values", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13604-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^[^?]*(?:<|%3[Cc])(?:script|img|svg|iframe|object|embed|body|input|details|math|video|audio|style|form|base|link|meta)(?:\\\\s|/|>|%20|%09|%2[Ff]|%3[Ee])~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via HTML tags in URL path segment", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13604-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^[^?]*(?:%6[Ff]|o)n(?:error|load|click|mouseover|focus|toggle)(?:\\\\s*(?:=|%3[Dd]))~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via event handlers in URL path segment", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13608-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[child_pages\\\\b[^\\\\]]*\\\\buse_custom_(?:link|link_target|thumbs|excerpt)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13608", "description": "CC Child Pages <=2.0.0 Authenticated (Contributor+) Stored XSS via child_pages shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cc-child-pages", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-13608-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[child_pages\\\\b[^\\\\]]*\\\\buse_custom_(?:link|link_target|thumbs|excerpt)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13608", "description": "CC Child Pages <=2.0.0 Authenticated (Contributor+) Stored XSS via child_pages shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cc-child-pages", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-1361-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "ip2location-country-blocker"}, {"type": "missing_capability", "value": "administrator"}], "cve": "CVE-2025-1361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1361", "description": "IP2Location Country Blocker <=2.38.8 missing authorization on admin_init allows unauthenticated settings disclosure", "mode": "block", "severity": 5.3, "slug": "ip2location-country-blocker", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.38.8"}, "RULE-CVE-2025-13610-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[RM_Forms\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:|on\\\\w+\\\\s*=)[^?]*(?:\\\\?|$)~i"}], "cve": "CVE-2025-13622", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13622", "description": "Jabbernotification <=0.99-RC2 reflected XSS via PATH_INFO in admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "jabberbenachrichtigung", "tags": ["xss", "reflected-xss", "path-info"], "target": "plugin", "versions": "<=0.99-RC2"}, "RULE-CVE-2025-13626-01": {"ajax_action": "mylco_pagerank", "conditions": [{"name": "ARGS:url", "type": "detectXSS"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via unsanitized url parameter in mylco_pagerank AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13626-02": {"ajax_action": "mylco_alexa", "conditions": [{"name": "ARGS:url", "type": "detectXSS"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via unsanitized url parameter in mylco_alexa AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13626-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php/(?:[^?]*(?:[<>\\"\']|%3c|%3e|%22|%27).*)?[?&]page=mylco(?:&|$)~i"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via $_SERVER[\'PHP_SELF\'] path-info injection on admin pages", "method": "GET", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13641-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?(?:/|[A-Za-z]:[/\\\\\\\\])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in post content (absolute path)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "php-file-inclusion", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in post content (directory traversal)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?(?:/|[A-Za-z]:[/\\\\\\\\])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in REST API content field (absolute path)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "php-file-inclusion", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in REST API content field (directory traversal)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "path-traversal", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13645-01": {"ajax_action": "modula_unzip_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13645", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13645", "description": "Modula Image Gallery <=2.13.2 authenticated arbitrary file/directory deletion via path traversal in ajax_unzip_file \\u2014 over-protection capability gate (payload is in zip binary, not HTTP params)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "modula-best-grid-gallery", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated", "over-protection"], "target": "plugin", "versions": "<=2.13.2"}, "RULE-CVE-2025-13646-01": {"ajax_action": "modula_unzip_file", "conditions": [{"name": "ARGS:fileID", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13646", "description": "Modula Image Gallery <=2.13.2 authenticated arbitrary file upload via modula_unzip_file AJAX handler", "method": "POST", "mode": "block", "severity": 6.6, "slug": "modula-best-grid-gallery", "tags": ["arbitrary-file-upload", "race-condition", "authenticated"], "target": "plugin", "versions": "<=2.13.2"}, "RULE-CVE-2025-13678-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[thailottery\\\\b[^\\\\]]*(?:width|height)\\\\s*=[\\\\s\\"\']*[^\\\\]]*(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|/])~i"}], "cve": "CVE-2025-13678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13678", "description": "Thai Lottery Widget <=2.5 authenticated stored XSS via thailottery shortcode width/height attributes in post content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "thai-lottery-widget", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.5"}, "RULE-CVE-2025-13678-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thailottery\\\\b[^\\\\]]*(?:width|height)\\\\s*=[\\\\s\\"\']*[^\\\\]]*(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|/])~i"}], "cve": "CVE-2025-13678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13678", "description": "Thai Lottery Widget <=2.5 authenticated stored XSS via thailottery shortcode width/height attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "thai-lottery-widget", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.5"}, "RULE-CVE-2025-13679-01": {"ajax_action": "tutor_order_details", "conditions": [{"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13679", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13679", "description": "Tutor LMS <=3.9.3 missing authorization on tutor_order_details AJAX action allows subscriber+ to exfiltrate order PII", "mode": "block", "severity": 6.5, "slug": "tutor", "tags": ["missing-authorization", "idor", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2025-13681-01": {"action": "admin_post_bfgtoexz_zip", "conditions": [{"name": "ARGS:first_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2e%2e[%2f%5c]){2,})~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13681", "description": "BFG Tools \\u2013 Extension Zipper <=1.0.7 authenticated path traversal via first_file parameter in admin_post_bfgtoexz_zip handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bfg-tools-extension-zipper", "tags": ["path-traversal", "arbitrary-file-read", "missing-authorization"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-13681-02": {"action": "admin_post_bfgtoexz_zip", "conditions": [{"name": "ARGS:first_file", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13681", "description": "BFG Tools \\u2013 Extension Zipper <=1.0.7 authenticated sensitive file read via first_file parameter in admin_post_bfgtoexz_zip handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bfg-tools-extension-zipper", "tags": ["path-traversal", "arbitrary-file-read", "sensitive-file-disclosure"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-13682-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit\\\\.php~"}, {"name": "ARGS:bulk_trail_networks_changed", "type": "regex", "value": "~<[a-zA-Z]{2,}|]+>|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13730", "description": "OpenID Connect Generic Client <=3.10.0 Stored XSS via shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "daggerhart-openid-connect-generic", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2025-13730-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[openid_connect_generic_auth_url\\\\b[^\\\\]]*(?:<[^>]+>|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13730", "description": "OpenID Connect Generic Client <=3.10.0 Stored XSS via shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "daggerhart-openid-connect-generic", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2025-13732-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[s2Eot\\\\b[^\\\\]]*(?:]|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|submit|blur|input|keydown|keyup|keypress|mousedown|mouseup|mouseenter|mouseleave|drag|drop|resize|scroll|wheel|pointer\\\\w+|focus(?:in|out))\\\\s*=)~i"}], "cve": "CVE-2025-13738", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13738", "description": "Easy Table of Contents <=2.0.78 Stored XSS via [ez-toc] shortcode attributes in Classic Editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-table-of-contents", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.78"}, "RULE-CVE-2025-13738-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ez-toc\\\\s+[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|video|audio|details|embed|object|marquee|body|input|button|select|textarea|form|meta|link|style|base)[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|submit|blur|input|keydown|keyup|keypress|mousedown|mouseup|mouseenter|mouseleave|drag|drop|resize|scroll|wheel|pointer\\\\w+|focus(?:in|out))\\\\s*=)~i"}], "cve": "CVE-2025-13738", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13738", "description": "Easy Table of Contents <=2.0.78 Stored XSS via [ez-toc] shortcode attributes in REST API post create/update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-table-of-contents", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.78"}, "RULE-CVE-2025-13739-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cryptx\\\\b[^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Display Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:nickname", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Nickname on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:first_name", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User First Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:last_name", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Last Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13838-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wishsuite_button[^\\\\]]*button_(?:text|added_text|exist_text)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*<[^>]*(?:on\\\\w+\\\\s*=|script|iframe|object|embed)~i"}], "cve": "CVE-2025-13838", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13838", "description": "WishSuite <=1.5.1 Stored XSS via wishsuite_button shortcode button_text attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wishsuite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-13838-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button[^\\\\]]*button_(?:text|added_text|exist_text)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*<[^>]*(?:on\\\\w+\\\\s*=|script|iframe|object|embed)~i"}], "cve": "CVE-2025-13838", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13838", "description": "WishSuite <=1.5.1 Stored XSS via wishsuite_button shortcode button_text attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wishsuite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-13840-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bukazu_search\\\\b[^\\\\]]*shortcode\\\\s*=\\\\s*(?:\\"[^\\"]*<|\'[^\']*<|[^\\\\s\\\\]]*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13840", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13840", "description": "BUKAZU Search Widget <=3.4 stored XSS via bukazu_search shortcode attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bukazu-search-widget", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.4"}, "RULE-CVE-2025-13840-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bukazu_search\\\\b[^\\\\]]*shortcode\\\\s*=\\\\s*(?:\\"[^\\"]*<|\'[^\']*<|[^\\\\s\\\\]]*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13840", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13840", "description": "BUKAZU Search Widget <=3.4 stored XSS via bukazu_search shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bukazu-search-widget", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.4"}, "RULE-CVE-2025-13846-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[easy_map_creator\\\\b[^\\\\]]*\\\\bwidth\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*(?:<|>|on\\\\w+\\\\s*=|javascript:|style\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13846", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13846", "description": "Easy Map Creator <=3.0.2 Stored XSS via shortcode width attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-map-creator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-13846-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[easy_map_creator\\\\b[^\\\\]]*\\\\bwidth\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*(?:<|>|on\\\\w+\\\\s*=|javascript:|style\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13846", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13846", "description": "Easy Map Creator <=3.0.2 Stored XSS via shortcode width attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-map-creator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-13852-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[lead_form\\\\s[^\\\\]]*configuration\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)|\'[^\']*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=))~i"}], "cve": "CVE-2025-13852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13852", "description": "Debt.com Business in a Box <=4.1.0 Stored XSS via lead_form shortcode configuration attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "debtcom-business-in-a-box", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-13852-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[lead_form\\\\s[^\\\\]]*configuration\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)|\'[^\']*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=))~i"}], "cve": "CVE-2025-13852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13852", "description": "Debt.com Business in a Box <=4.1.0 Stored XSS via lead_form shortcode configuration attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "debtcom-business-in-a-box", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-13853-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]nn-tech[^]]*data_tech *=[^]]*(<[^>]+on[a-zA-Z]+=|]+onerror|#]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|start|animationend|beforeprint|change|dblclick|drag|drop|ended|hashchange|input|invalid|key(?:down|press|up)|mouse(?:down|enter|leave|move|out|over|up)|page(?:show|hide)|paste|play|pointer|progress|resize|scroll|search|select|submit|touch|transition|unload|wheel)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64\\\\s*,~i"}], "cve": "CVE-2025-13861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13861", "description": "HTML Forms <=1.6.0 unauthenticated stored XSS via form field values on hf_form_submit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.1, "slug": "html-forms", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-13861-02": {"action": "init", "conditions": [{"name": "ARGS:_hf_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|svg|img|iframe|object|embed|details|marquee|video|audio|body|math|xmp|isindex|style|link|base|meta|form|input|button|select|textarea|keygen|source|track|frameset|frame|applet|xml)[\\\\s/>#]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|start|animationend|beforeprint|change|dblclick|drag|drop|ended|hashchange|input|invalid|key(?:down|press|up)|mouse(?:down|enter|leave|move|out|over|up)|page(?:show|hide)|paste|play|pointer|progress|resize|scroll|search|select|submit|touch|transition|unload|wheel)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64\\\\s*,~i"}], "cve": "CVE-2025-13861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13861", "description": "HTML Forms <=1.6.0 unauthenticated stored XSS via non-AJAX form submission with _hf_form_id", "method": "POST", "mode": "block", "severity": 6.1, "slug": "html-forms", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-13864-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/breeze/v1/clear-all-cache(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13864", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13864", "description": "Breeze <=2.2.21 unauthenticated cache clearing via REST API endpoint breeze/v1/clear-all-cache", "method": "POST", "mode": "block", "severity": 5.3, "slug": "breeze", "tags": ["missing-authorization", "unauthenticated", "rest-api", "cache-deletion"], "target": "plugin", "versions": "<=2.2.21"}, "RULE-CVE-2025-13880-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-social-reviews/v1/advance-settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13880", "description": "WP Social Ninja <=4.0.1 unauthenticated access to advanced settings via REST API (GET)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "wp-social-reviews", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-13880-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-social-reviews/v1/advance-settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13880", "description": "WP Social Ninja <=4.0.1 unauthenticated modification of advanced settings via REST API (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-social-reviews", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-13886-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[book\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [book] shortcode template attribute", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[books\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [books] shortcode template attribute", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[book\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [book] shortcode template attribute (Gutenberg REST API)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[books\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [books] shortcode template attribute (Gutenberg REST API)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13887-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ai_botkit_widget\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:[<>\\"\']|&#|on\\\\w+\\\\s*=)|(?=[^\\\\s\\\\]\\"\'])[^^\\\\s\\\\]]*(?:[<>]|on\\\\w+\\\\s*=))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13887", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13887", "description": "AI BotKit <=1.1.7 Authenticated (Contributor+) Stored XSS via ai_botkit_widget shortcode id attribute in classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-botkit-for-lead-generation", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-13887-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ai_botkit_widget\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:[<>\\"\']|&#|on\\\\w+\\\\s*=)|(?=[^\\\\s\\\\]\\"\'])[^^\\\\s\\\\]]*(?:[<>]|on\\\\w+\\\\s*=))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13887", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13887", "description": "AI BotKit <=1.1.7 Authenticated (Contributor+) Stored XSS via ai_botkit_widget shortcode id attribute in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-botkit-for-lead-generation", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-13889-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[snivo\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13889", "description": "Simple Nivo Slider <=0.5.6 Stored XSS via [snivo] shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-nivo-slider", "tags": ["xss", "stored-xss", "shortcode", "contributor"], "target": "plugin", "versions": "<=0.5.6"}, "RULE-CVE-2025-13889-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[snivo\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13889", "description": "Simple Nivo Slider <=0.5.6 Stored XSS via [snivo] shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-nivo-slider", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "contributor"], "target": "plugin", "versions": "<=0.5.6"}, "RULE-CVE-2025-13896-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[igp-wp\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*[<>;()\\\\\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13896", "description": "Social Feed Gallery Portfolio <=1.3 Stored XSS via igp-wp shortcode id attribute (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-feed-gallery-portfolio", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-13897-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:aft_testimonial_meta_name", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13897", "description": "Client Testimonial Slider <=2.0 stored XSS via aft_testimonial_meta_name metabox field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-client-testimonial", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-13897-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:aft_testimonial_meta_company", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13897", "description": "Client Testimonial Slider <=2.0 stored XSS via aft_testimonial_meta_company metabox field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-client-testimonial", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-13898-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ultra_skype\\\\b[^\\\\]]*btn_id\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:]*ontogg)~i"}], "cve": "CVE-2025-13898", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13898", "description": "Ultra Skype Button <=1.0 Stored XSS via [ultra_skype] shortcode btn_id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultra-skype-button", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-13898-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ultra_skype\\\\b[^\\\\]]*btn_id\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:]*ontogg)~i"}], "cve": "CVE-2025-13898", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13898", "description": "Ultra Skype Button <=1.0 Stored XSS via REST API post creation with [ultra_skype] shortcode btn_id attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultra-skype-button", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-13904-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gancio-events?\\\\b[^\\\\]]*(?:on[a-z]+=|javascript\\\\s*:|\\\\s*<)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13906", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13906", "description": "WP Flot <=0.2.2 Stored XSS via [linechart] shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-flot", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.2"}, "RULE-CVE-2025-13906-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:linechart|barchart|piechart)\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|\\\\s*<)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13906", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13906", "description": "WP Flot <=0.2.2 Stored XSS via [linechart] shortcode attributes in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-flot", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.2.2"}, "RULE-CVE-2025-13907-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]button[^]]*(?:\\\\b(?:href|url|link)\\\\s*=\\\\s*([\\"\'])\\\\s*(?:javascript:|data:)|on(?:abort|blur|change|click|dblclick|error|focus|input|keydown|keypress|keyup|load|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|reset|resize|scroll|submit|unload)\\\\s*=|]*ontoggle)~i"}], "cve": "CVE-2025-13908", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13908", "description": "The Tooltip <=1.0.2 Stored XSS via [the_tooltip] shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-tooltip", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-13908-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[the_tooltip\\\\b[^\\\\]]*(?:[\\\\s\\"\']on(?:click|error|load|mouseover|focus|blur|toggle|change|submit|key(?:down|up|press)|pointer(?:down|up)|mouseenter|mouseleave)\\\\s*=|javascript:|]*ontoggle)~i"}], "cve": "CVE-2025-13908", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13908", "description": "The Tooltip <=1.0.2 Stored XSS via [the_tooltip] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-tooltip", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-13958-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode attribute event handler injection in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\]\\\\s*\\\\}~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode JS context breakout in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*[\'\\"]\\\\s*/?>\\\\s*<~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode HTML tag injection in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode attribute event handler injection via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\]\\\\s*\\\\}~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode JS context breakout via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*[\'\\"]\\\\s*/?>\\\\s*<~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode HTML tag injection via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13963-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[fxcc_convert\\\\b[^\\\\]]*(?:tmpl|prefix|suffix)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:]+\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bontoggle\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13963", "description": "FX Currency Converter <=0.2.0 Stored XSS via fxcc_convert shortcode attributes (tmpl/prefix/suffix)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fx-currency-converter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2025-13963-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[fxcc_convert\\\\b[^\\\\]]*\\\\][^\\\\[]*(?:]+\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bontoggle\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13963", "description": "FX Currency Converter <=0.2.0 Stored XSS via fxcc_convert shortcode enclosed content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fx-currency-converter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2025-13964-01": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_add_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section creation via lp-load-ajax=course_add_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-02": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_update_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section update via lp-load-ajax=course_update_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-03": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_delete_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section deletion via lp-load-ajax=course_delete_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-04": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_update_section_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated section reorder via lp-load-ajax=course_update_section_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-05": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "create_item_add_to_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item creation via lp-load-ajax=create_item_add_to_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-06": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "add_items_to_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item addition via lp-load-ajax=add_items_to_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-07": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "delete_item_from_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item deletion via lp-load-ajax=delete_item_from_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-08": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_item_section_and_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item move via lp-load-ajax=update_item_section_and_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-09": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_items_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item reorder via lp-load-ajax=update_items_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-10": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_item_of_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item update via lp-load-ajax=update_item_of_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13972-01": {"action": "parse_request", "conditions": [{"name": "ARGS:wht_download_big_object", "type": "exists"}, {"name": "ARGS:wht_download_big_object_origin", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|[\\\\\\\\/]proc[\\\\\\\\/]|[\\\\\\\\/]var[\\\\\\\\/]log|wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-13972", "mode": "block", "severity": 4.9, "slug": "watchtowerhq", "target": "plugin", "versions": "<=3.16.0"}, "RULE-CVE-2025-13973-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-content/uploads/stickeasy-protected-contact-form/spcf-log(?:(?:\\\\.|%2e)(?:txt|log))?|wp-content/uploads/stickeasy-protected-contact-form/)(?:$|[\\\\?#])~i"}], "cve": "CVE-2025-13973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13973", "description": "StickEasy Protected Contact Form <=1.0.1 unauthenticated information disclosure via predictable spam log file path (v1.0.0 uploads directory)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "stickeasy-protected-contact-form", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13973-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-content/spcf-logs/spcf-log(?:(?:\\\\.|%2e)(?:txt|log))?|wp-content/spcf-logs/)(?:$|[\\\\?#])~i"}], "cve": "CVE-2025-13973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13973", "description": "StickEasy Protected Contact Form <=1.0.1 unauthenticated information disclosure via predictable spam log file path (v1.0.1 spcf-logs directory)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "stickeasy-protected-contact-form", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13974-01": {"ajax_action": "thwecmf_template_actions", "conditions": [{"name": "ARGS:contents", "type": "regex", "value": "~<\\\\s*(?:script|iframe|embed|object)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|change|submit|input)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]+\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13974", "description": "Email Customizer for WooCommerce <=2.6.7 authenticated stored XSS via template content save", "method": "POST", "mode": "block", "severity": 4.4, "slug": "email-customizer-for-woocommerce", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.6.7"}, "RULE-CVE-2025-13977-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-13977", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13989-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_dropzone[^\\\\]]*callback\\\\s*=~i"}], "cve": "CVE-2025-13989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13989", "description": "WP Dropzone <=1.1.1 authenticated (Contributor+) stored XSS via callback shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-dropzone", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13989-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_dropzone[^\\\\]]*callback\\\\s*=~i"}], "cve": "CVE-2025-13989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13989", "description": "WP Dropzone <=1.1.1 authenticated (Contributor+) stored XSS via callback shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-dropzone", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13999-01": {"ajax_action": "h5ap_get_stream_data", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "h5ap_get_stream_data"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:file|gopher|dict|ftp|tftp|ldap|ssh)://~i"}, {"name": "ARGS:url", "type": "exists"}], "cve": "CVE-2025-13999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13999", "description": "HTML5 Audio Player <=2.5.1 unauthenticated SSRF via h5ap_get_stream_data AJAX action url parameter", "mode": "block", "severity": 7.2, "slug": "html5-audio-player", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": ">=2.4.0 <=2.5.1"}, "RULE-CVE-2025-13999-02": {"ajax_action": "h5ap_get_stream_data", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "h5ap_get_stream_data"}, {"name": "ARGS:url", "type": "regex", "value": "~https?://(?:localhost|127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0177\\\\.|0x7f|2130706433|metadata\\\\.google\\\\.internal)~i"}], "cve": "CVE-2025-13999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13999", "description": "HTML5 Audio Player <=2.5.1 unauthenticated SSRF via h5ap_get_stream_data targeting localhost/internal IPs", "mode": "block", "severity": 7.2, "slug": "html5-audio-player", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": ">=2.4.0 <=2.5.1"}, "RULE-CVE-2025-14000-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[restrict\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b|<\\\\s*img\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14000", "description": "Membership Plugin \\u2013 Restrict Content <=3.2.15 authenticated (Contributor+) stored XSS via [restrict] shortcode attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "restrict-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2025-14000-02": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[register_form\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b|<\\\\s*img\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14000", "description": "Membership Plugin \\u2013 Restrict Content <=3.2.15 authenticated (Contributor+) stored XSS via [register_form] shortcode attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "restrict-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2025-14001-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wp_duplicate_page_bulk_action"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-14001", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14001", "description": "WP Duplicate Page <=1.8 missing authorization on bulk post duplication via action parameter", "mode": "block", "severity": 5.4, "slug": "wp-duplicate-page", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-14001-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action2", "type": "equals", "value": "wp_duplicate_page_bulk_action"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-14001", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14001", "description": "WP Duplicate Page <=1.8 missing authorization on bulk post duplication via action2 parameter", "mode": "block", "severity": 5.4, "slug": "wp-duplicate-page", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-14030-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[\\\\s*aife_post_meta\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14030", "description": "AI Feeds <=1.0.22 Authenticated (Contributor+) Stored XSS via aife_post_meta shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-feeds", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.22"}, "RULE-CVE-2025-14030-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[\\\\s*aife_post_meta\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14030", "description": "AI Feeds <=1.0.22 Authenticated (Contributor+) Stored XSS via aife_post_meta shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-feeds", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.22"}, "RULE-CVE-2025-14032-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:bold_timeline_group|bold_timeline_item)\\\\b[^\\\\]]*\\\\btitle\\\\s*=\\\\s*(?:\\"[^\\"]*[<>][^\\"]*\\"|\'[^\']*[<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14032", "description": "Bold Timeline Lite <=1.2.7 stored XSS via title attribute in bold_timeline_group shortcode (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-timeline-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-14032-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:bold_timeline_group|bold_timeline_item)\\\\b[^\\\\]]*\\\\btitle\\\\s*=\\\\s*(?:\\"[^\\"]*[<>][^\\"]*\\"|\'[^\']*[<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14032", "description": "Bold Timeline Lite <=1.2.7 stored XSS via title attribute in bold_timeline_group shortcode (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-timeline-lite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-14039-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_client_name", "type": "regex", "value": "~(?:]|]+onerror\\\\s*=|]+onload\\\\s*=|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via _simple_folio_item_client_name meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14039-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_link", "type": "regex", "value": "~(?:]|]+onerror\\\\s*=|]+onload\\\\s*=|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|])~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via _simple_folio_item_link meta field (HTML injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14039-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_link", "type": "regex", "value": "~j\\\\s*a\\\\s*v\\\\s*a\\\\s*s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t\\\\s*:~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via javascript protocol in _simple_folio_item_link href", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14049-01": {"action": "admin_post_nopriv_vikrentitems", "conditions": [{"name": "ARGS:delto", "type": "detectXSS"}], "cve": "CVE-2025-14049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14049", "description": "VikRentItems <=1.2.0 reflected XSS via delto parameter on unauthenticated admin-post endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vikrentitems", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-14049-02": {"action": "admin_post_vikrentitems", "conditions": [{"name": "ARGS:delto", "type": "detectXSS"}], "cve": "CVE-2025-14049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14049", "description": "VikRentItems <=1.2.0 reflected XSS via delto parameter on authenticated admin-post endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vikrentitems", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-1405-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[show_products"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[show_products\\\\s[^\\\\]]*(?:on\\\\w+\\\\s*=|]*>~"}], "cve": "CVE-2025-14056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14056", "description": "Custom Post Type UI <=1.18.1 Stored XSS via label in cptui_post_import JSON on Tools page", "method": "POST", "mode": "block", "severity": 4.4, "slug": "custom-post-type-ui", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.18.1"}, "RULE-CVE-2025-14056-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cptui_tools"}, {"name": "ARGS:cptui_tax_import", "type": "regex", "value": "~<[a-zA-Z!/][^>]*>~"}], "cve": "CVE-2025-14056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14056", "description": "Custom Post Type UI <=1.18.1 Stored XSS via label in cptui_tax_import JSON on Tools page", "method": "POST", "mode": "block", "severity": 4.4, "slug": "custom-post-type-ui", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.18.1"}, "RULE-CVE-2025-1406-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[npc\\\\b[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|>|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1406", "description": "Newpost Catch <=1.3.19 authenticated (contributor+) stored XSS via npc shortcode id attribute in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "newpost-catch", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.19"}, "RULE-CVE-2025-1406-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[npc\\\\b[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|>|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1406", "description": "Newpost Catch <=1.3.19 authenticated (contributor+) stored XSS via npc shortcode id attribute in REST content field", "method": "POST", "mode": "block", "severity": 5.4, "slug": "newpost-catch", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3.19"}, "RULE-CVE-2025-14061-01": {"ajax_action": "gdpr_delete_policy_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14061", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14061", "description": "WP Cookie Consent <=4.0.7 missing authorization on gdpr_delete_policy_data AJAX handler allowing unauthenticated arbitrary post deletion", "mode": "block", "severity": 5.3, "slug": "gdpr-cookie-consent", "tags": ["missing-authorization", "arbitrary-post-deletion", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-14064-01": {"ajax_action": "get_board", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on get_board AJAX endpoint allows unauthorized access to any group task board", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-02": {"ajax_action": "add_new_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on add_new_task AJAX endpoint allows unauthorized task creation", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-03": {"ajax_action": "edit_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on edit_task AJAX endpoint allows unauthorized task modification", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-04": {"ajax_action": "delete_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on delete_task AJAX endpoint allows unauthorized task deletion", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-05": {"ajax_action": "reorder_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on reorder_task AJAX endpoint allows unauthorized task reordering", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-06": {"ajax_action": "get_tasks", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on get_tasks AJAX endpoint allows unauthorized task data access", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-07": {"ajax_action": "edit_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on edit_list AJAX endpoint allows unauthorized list modification", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-08": {"ajax_action": "users_autocomplete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on users_autocomplete AJAX endpoint allows unauthorized user enumeration", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "info-disclosure"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-09": {"ajax_action": "add_users_to_assign_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on add_users_to_assign_list AJAX endpoint allows unauthorized user assignment", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14069-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/profile.php"}, {"name": "ARGS:saswp_custom_schema_field", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14069", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14069", "description": "Schema & Structured Data for WP & AMP <=1.54 Stored XSS via saswp_custom_schema_field on profile self-update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.54"}, "RULE-CVE-2025-14069-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/user-edit.php"}, {"name": "ARGS:saswp_custom_schema_field", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14069", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14069", "description": "Schema & Structured Data for WP & AMP <=1.54 Stored XSS via saswp_custom_schema_field on user-edit profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.54"}, "RULE-CVE-2025-14071-01": {"ajax_action": "dslc-ajax-save-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~[OC]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-14071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14071", "description": "Live Composer <=2.0.2 PHP Object Injection via dslc-ajax-save-composer AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-14071-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[dslc_module_(?:posts|projects|partners|staff|testimonials|galleries)_output\\\\][^\\\\[]*[OC]:\\\\d+:~"}], "cve": "CVE-2025-14071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14071", "description": "Live Composer <=2.0.2 PHP Object Injection via post_content containing dslc_module shortcode", "method": "POST", "mode": "block", "severity": 7.5, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-14071-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[dslc_module_(?:posts|projects|partners|staff|testimonials|galleries)_output\\\\][^\\\\[]*[OC]:\\\\d+:~"}], "cve": "CVE-2025-14071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14071", "description": "Live Composer <=2.0.2 PHP Object Injection via REST API post content containing dslc_module shortcode", "method": "POST", "mode": "block", "severity": 7.5, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-14079-01": {"ajax_action": "eh_crm_ticket_general", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14079", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14079", "description": "ELEX WordPress HelpDesk & Customer Support Ticket System <=3.3.5 missing authorization on eh_crm_ticket_general AJAX settings update", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.3.5"}, "RULE-CVE-2025-14109-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[column\\\\s[^\\\\]]*column\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14109", "description": "AH Shortcodes <=1.0.2 Stored XSS via [column] shortcode attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ah-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-14109-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[column\\\\s[^\\\\]]*column\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14109", "description": "AH Shortcodes <=1.0.2 Stored XSS via [column] shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ah-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-14110-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(list-pages|child-pages|tree-pages)\\\\s[^\\\\]]*class\\\\s*=\\\\s*[\\\\\\"\'][^\\\\]]*(?:<|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14110", "description": "WP Js List Pages Shortcodes <=1.21 stored XSS via shortcode class attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-js-list-pages-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.21"}, "RULE-CVE-2025-14112-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~snillrik_restaurant_menu[^\\\\]]*menu_style\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[^>]+>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14112", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14112", "description": "Snillrik Restaurant Menu <=2.2.1 Stored XSS via menu_style shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "snillrik-restaurant-menu", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-14112-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~snillrik_restaurant_menu[^\\\\]]*menu_style\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[^>]+>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14112", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14112", "description": "Snillrik Restaurant Menu <=2.2.1 Stored XSS via menu_style shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "snillrik-restaurant-menu", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-14113-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[link\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|\\\\bon[a-z]+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-14113", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14113", "description": "Viitor Button Shortcodes <=3.0.0 Stored XSS via [link] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "viitor-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-14113-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[link\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|\\\\bon[a-z]+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-14113", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14113", "description": "Viitor Button Shortcodes <=3.0.0 Stored XSS via [link] shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "viitor-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-14114-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(row|span|column)[^\\\\]]*class\\\\s*=\\\\s*[\'\\"][^\'\\"]*(<|on[a-z]+=|javascript:|&#)~i"}], "cve": "CVE-2025-14114", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14114", "description": "1180px Shortcodes <=1.1.1 authenticated (Contributor+) stored XSS via shortcode class attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "1180px-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14114-02": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(row|span|column)[^\\\\]]*class\\\\s*=\\\\s*[\'\\"][^\'\\"]*(<|on[a-z]+=|javascript:|&#)~i"}], "cve": "CVE-2025-14114", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14114", "description": "1180px Shortcodes <=1.1.1 authenticated (Contributor+) stored XSS via shortcode class attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "1180px-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14119-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[atvc_video_play\\\\b[^\\\\]]*(?:on[a-zA-Z]+=|javascript:|]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14142", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14142", "description": "Electric Enquiries <=1.1 Stored XSS via button attribute of electric-enquiry shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "electric-enquiries", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-14143-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*(?:javascript|expression)\\\\s*[:(/]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute containing javascript URI in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*<[a-z]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute with tag injection in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (event handler)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*(?:javascript|expression)\\\\s*[:(/]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (javascript URI)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*<[a-z]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (tag injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14144-01": {"ajax_action": "ajax_live_preview", "conditions": [{"name": "ARGS:shortcodeData", "type": "regex", "value": "~]*>|javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|mouseenter|mouseout|mousemove|keydown|keyup|keypress|submit|change|input|animationend|animationstart)\\\\s*=~i"}], "cve": "CVE-2025-14144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14144", "description": "Mstoic Shortcodes <=2.0 reflected XSS via shortcodeData in ajax_live_preview AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mstoic-shortcodes", "tags": ["xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14144-02": {"ajax_action": "mstoic_shortcodes_print_images", "conditions": [{"name": "ARGS:mstoicImgCount", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-14144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14144", "description": "Mstoic Shortcodes <=2.0 reflected XSS via mstoicImgCount in mstoic_shortcodes_print_images AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mstoic-shortcodes", "tags": ["xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14147-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gist\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-14147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14147", "description": "Easy GitHub Gist Shortcodes <=1.0 Stored XSS via gist shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-github-gist-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14147-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gist\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-14147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14147", "description": "Easy GitHub Gist Shortcodes <=1.0 Stored XSS via gist shortcode id attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-github-gist-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14151-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS:outbound_resource", "type": "regex", "value": "~(?i)(?:<\\\\s*(?:script|svg)\\\\b|\\\\bon(?:load|error)\\\\s*=|\\\\bjavascript\\\\s*:)~"}], "cve": "CVE-2025-14151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14151", "description": "SlimStat Analytics <=5.3.2 unauthenticated stored XSS via outbound_resource parameter in slimtrack AJAX action", "mode": "block", "severity": 6.1, "slug": "wp-slimstat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.3.2"}, "RULE-CVE-2025-14154-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~join_chat$~"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14154", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14154", "description": "Better Messages <=2.10.2 stored XSS via unauthenticated guest display name in join chat", "method": "POST", "mode": "block", "severity": 6.1, "slug": "bp-better-messages", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.10.2"}, "RULE-CVE-2025-14156-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fox-lms/v1/payments/create-order(/|\\\\?|&|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2025-14156", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14156", "description": "Fox LMS >=1.0.4.7 <=1.0.5.1 unauthenticated privilege escalation via role parameter in create-order REST endpoint", "method": "POST", "mode": "block", "severity": 9.8, "slug": "fox-lms", "tags": ["privilege-escalation", "unauthenticated", "rest-api"], "target": "plugin", "versions": ">=1.0.4.7 <=1.0.5.1"}, "RULE-CVE-2025-14172-01": {"ajax_action": "cwpp_trigger_flush_rewrite_rules", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14172", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14172", "description": "WP Page Permalink Extension <=1.5.4 missing authorization on cwpp_trigger_flush_rewrite_rules AJAX action allows Subscriber+ to flush rewrite rules", "mode": "block", "severity": 6.5, "slug": "change-wp-page-permalinks", "tags": ["missing-authorization", "broken-access-control", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-14293-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^/|^[A-Za-z]:\\\\\\\\)~"}], "cve": "CVE-2025-14293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14293", "description": "WP Job Portal <=2.4.0 authenticated arbitrary file read via path traversal in filename parameter", "mode": "block", "severity": 6.5, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-read", "local-file-inclusion"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-14298-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes in post content (post.php, event handler breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes via REST API (style breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes via REST API (event handler breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14386-02": {"ajax_action": "validate_sso_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14386", "description": "Search Atlas SEO (metasync) <=2.5.11 missing authorization on validate_sso_token AJAX handler allows Subscriber+ to validate/consume admin SSO token", "method": "POST", "mode": "block", "severity": 8.8, "slug": "metasync", "tags": ["missing-authorization", "authentication-bypass", "privilege-escalation"], "target": "plugin", "versions": ">=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14386-03": {"ajax_action": "check_sso_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14386", "description": "Search Atlas SEO (metasync) <=2.5.11 missing authorization on check_sso_status AJAX handler allows Subscriber+ to query SSO status", "method": "POST", "mode": "block", "severity": 8.8, "slug": "metasync", "tags": ["missing-authorization", "authentication-bypass", "privilege-escalation"], "target": "plugin", "versions": ">=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14388-01": {"action": "init", "conditions": [{"name": "ARGS:phast", "type": "exists"}, {"name": "ARGS:src", "type": "regex", "value": "~(?:%00|%2500|\\\\x00)~"}], "cve": "CVE-2025-14388", "method": "GET", "mode": "block", "severity": 9.8, "slug": "phastpress", "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-1440-01": {"ajax_action": "aip_map_url_action", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^(?!https?://)~i"}], "cve": "CVE-2025-1440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1440", "description": "Advanced iFrame <=2024.5 unauthenticated URL mapping injection via aip_map_url_action - blocks non-HTTP(S) scheme URLs (javascript, data, ftp, etc.)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "advanced-iframe", "tags": ["improper-input-validation", "option-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2024.5"}, "RULE-CVE-2025-1441-01": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_no_results", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_no_results param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-02": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_number_of_words", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_number_of_words param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-03": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_view_result_text", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_view_result_text param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-04": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_ajax_search_link_target", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_ajax_search_link_target param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-05": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:grid_settings", "type": "regex", "value": "~<[a-z/!?]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (grid_settings JSON param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-14437-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wphb-log-action=download~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wphb-log-module=~i"}], "cve": "CVE-2025-14437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14437", "description": "Hummingbird Performance <=3.18.0 unauthenticated log file download via Logger::process_actions wphb-log-action parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hummingbird-performance", "tags": ["information-disclosure", "sensitive-data-exposure", "unauthenticated", "log-file-download"], "target": "plugin", "versions": "<=3.18.0"}, "RULE-CVE-2025-14440-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "jay_login_register_switch_back"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14440", "method": "GET", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.4.01"}, "RULE-CVE-2025-14441-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popupkit/v1/subscribers(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14441", "description": "PopupKit (Starter Templates & Starter Blocks for Starter Sites) <=2.2.0 missing authorization on DELETE /popupkit/v1/subscribers REST endpoint allows authenticated subscriber+ arbitrary subscriber data deletion", "method": "DELETE", "mode": "block", "severity": 5.3, "slug": "popup-builder-block", "tags": ["missing-authorization", "broken-access-control", "rest-api", "data-deletion"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2025-14442-01": {"ajax_action": "ays_sccp_results_export_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14442", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14442", "description": "Secure Copy Content Protection <=4.9.2 unauthenticated information disclosure via ays_sccp_results_export_file AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-copy-content-protection", "tags": ["information-disclosure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.9.2"}, "RULE-CVE-2025-14442-02": {"ajax_action": "ays_sccp_results_export_filter", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14442", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14442", "description": "Secure Copy Content Protection <=4.9.2 unauthenticated information disclosure via ays_sccp_results_export_filter AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-copy-content-protection", "tags": ["information-disclosure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.9.2"}, "RULE-CVE-2025-14445-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "points_image"}, {"name": "ARGS", "type": "regex", "value": "~(?:PHNjcmlwdD|PGltZyBzcmM9eCBvbmVycm9y|PGltZyBzcmM9eCBvbm|b25sb2FkPQ|b25lcnJvcj|b25jbGljaz|b25tb3VzZW92ZXI9|amF2YXNjcmlwdDo|PHN2Zy|PGJvZHkgb25sb2Fk|PGRldGFpbHMgb3Blbg|PGlmcmFtZSBzcmNkb2M)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14445", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14445", "description": "Image Hotspot by DevVN <=1.2.9 stored XSS via pointdata custom field on points_image post type save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "devvn-image-hotspot", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2025-14445-02": {"ajax_action": "devvn_ihotspot_clone_point", "conditions": [{"type": "missing_capability", "value": "edit_posts"}, {"name": "ARGS:post_id", "type": "exists"}], "cve": "CVE-2025-14445", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14445", "description": "Image Hotspot by DevVN <=1.2.9 missing authorization on devvn_ihotspot_clone_point AJAX handler allows authenticated users to clone hotspot posts", "method": "POST", "mode": "block", "severity": 6.4, "slug": "devvn-image-hotspot", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2025-14446-01": {"ajax_action": "easynotify_cp_reset", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14446", "description": "Popup Builder (Easy Notify Lite) <=1.1.37 missing authorization on easynotify_cp_reset AJAX action allows authenticated Subscriber+ users to reset plugin settings", "mode": "block", "severity": 6.5, "slug": "easy-notify-lite", "tags": ["missing-authorization", "broken-access-control", "settings-reset"], "target": "plugin", "versions": "<=1.1.37"}, "RULE-CVE-2025-14448-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)profile\\\\.php~"}, {"name": "ARGS:wpmem_dynamic_field", "type": "regex", "value": "~(?:<|&(?:#0*60|#x0*3c|lt);)[a-z/!].*?(?:>|&(?:#0*62|#x0*3e|gt);)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|&(?:#0*60|#x0*3c|lt);)script~i"}], "cve": "CVE-2025-14448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14448", "description": "WP-Members <=3.5.4.3 stored XSS via unsanitized multiselect/multicheckbox profile fields on profile.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.4.3"}, "RULE-CVE-2025-14448-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)user-edit\\\\.php~"}, {"name": "ARGS:wpmem_dynamic_field", "type": "regex", "value": "~(?:<|&(?:#0*60|#x0*3c|lt);)[a-z/!].*?(?:>|&(?:#0*62|#x0*3e|gt);)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|&(?:#0*60|#x0*3c|lt);)script~i"}], "cve": "CVE-2025-14448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14448", "description": "WP-Members <=3.5.4.3 stored XSS via unsanitized multiselect/multicheckbox profile fields on user-edit.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.4.3"}, "RULE-CVE-2025-14450-01": {"ajax_action": "change_wallet_fund_request_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14450", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14450", "description": "Wallet System for WooCommerce <=2.7.2 missing authorization on change_wallet_fund_request_status AJAX action allows Subscriber+ to manipulate wallet balances", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wallet-system-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2025-14452-01": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "wpcr3_review"}, {"name": "ARGS:wpcr3_fname", "type": "regex", "value": "~(?:]|on(?:load|error|focus|click|mouseover|mouseout|keydown|keyup|change|submit|blur|dblclick|input|resize)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14452", "description": "WP Customer Reviews <=3.7.5 reflected XSS via wpcr3_fname parameter on admin review list", "method": "GET", "mode": "block", "severity": 7.2, "slug": "wp-customer-reviews", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.7.5"}, "RULE-CVE-2025-14453-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[myg_album_gallery\\\\b[^\\\\]]*style_css\\\\s*=[^\\\\]]*(?:\\"|\')[^\\"\']*(?:on\\\\w+\\\\s*=|]~i"}], "cve": "CVE-2025-14467", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.3.9"}, "RULE-CVE-2025-14467-02": {"action": "init", "conditions": [{"name": "ARGS:wpjobportalme", "type": "equals", "value": "job"}, {"name": "ARGS:description", "type": "regex", "value": "~]~i"}], "cve": "CVE-2025-14467", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.3.9"}, "RULE-CVE-2025-14477-01": {"ajax_action": "ajaxUpdatePaginationLinks", "conditions": [{"name": "ARGS:filterText", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:SELECT|DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\\\\s|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|/\\\\*[^*]*\\\\*/\\\\s*(?:UNION|SELECT|DROP|INSERT|UPDATE|DELETE))~i"}], "cve": "CVE-2025-14477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14477", "description": "404 Solution <=3.1.0 authenticated (Admin+) SQL injection via filterText parameter in ajaxUpdatePaginationLinks AJAX action", "method": "POST", "mode": "block", "severity": 4.9, "slug": "404-solution", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-14506-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:convertforce/conversion"}, {"name": "ARGS:content", "type": "contains", "value": "\\"type\\":\\"slide_in\\""}, {"name": "ARGS:content", "type": "regex", "value": "~\\"entrance_animation\\"\\\\s*:\\\\s*\\\\{[^}]*\\"name\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*(?:<|>|\\\\\\\\\\"|\\\\s+on[a-z]+\\\\s*=)(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\"~i"}], "cve": "CVE-2025-14506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14506", "description": "ConvertForce Popup Builder <=0.0.7 stored XSS via entrance_animation block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "convertforce-popup-builder", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.0.7"}, "RULE-CVE-2025-14506-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:convertforce/conversion"}, {"name": "ARGS:post_content", "type": "contains", "value": "\\"type\\":\\"slide_in\\""}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\"entrance_animation\\"\\\\s*:\\\\s*\\\\{[^}]*\\"name\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*(?:<|>|\\\\\\\\\\"|\\\\s+on[a-z]+\\\\s*=)(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\"~i"}], "cve": "CVE-2025-14506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14506", "description": "ConvertForce Popup Builder <=0.0.7 stored XSS via entrance_animation block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "convertforce-popup-builder", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.0.7"}, "RULE-CVE-2025-14508-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mediacommander/v1/import-csv(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14508", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14508", "description": "MediaCommander <=2.3.1 missing authorization on import-csv REST endpoint allows Author+ to delete all media folder data", "method": "POST", "mode": "block", "severity": 6.5, "slug": "mediacommander", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2025-1453-01": {"ajax_action": "save-widget", "conditions": [{"name": "ARGS:id_base", "type": "equals", "value": "category-posts"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1453", "description": "Category Posts Widget <=4.9.19 stored XSS via widget template field (AJAX save-widget path)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "category-posts", "tags": ["xss", "stored-xss", "widget"], "target": "plugin", "versions": "<=4.9.19"}, "RULE-CVE-2025-1453-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/widgets\\\\.php~"}, {"name": "ARGS:id_base", "type": "equals", "value": "category-posts"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1453", "description": "Category Posts Widget <=4.9.19 stored XSS via widget template field (classic widgets.php POST path)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "category-posts", "tags": ["xss", "stored-xss", "widget"], "target": "plugin", "versions": "<=4.9.19"}, "RULE-CVE-2025-14533-01": {"ajax_action": "nopriv_endpoint/form/shortcode", "conditions": [{"type": "missing_capability", "value": "promote_users"}, {"name": "ARGS", "type": "regex", "value": "~^(?:administrator|super_admin)$~"}], "cve": "CVE-2025-14533", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": "<=0.9.2.1"}, "RULE-CVE-2025-14539-01": {"ajax_action": "shortcode_ajax", "conditions": [{"name": "ARGS:code", "type": "regex", "value": "~\\\\[[a-zA-Z_][^\\\\]]*\\\\]~"}], "cve": "CVE-2025-14539", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14539", "description": "Shortcode Ajax <=1.0 unauthenticated arbitrary shortcode execution via code parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcode-ajax", "tags": ["code-injection", "arbitrary-shortcode-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14548-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:event_desc", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_desc on add action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:event_title", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_title on add action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "edit_save"}, {"name": "ARGS:event_desc", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_desc on edit_save action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "edit_save"}, {"name": "ARGS:event_title", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_title on edit_save action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-1455-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1455", "description": "Royal Elementor Addons <=1.7.1012 Stored XSS via Woo Grid widget settings on Elementor REST save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.7.1012"}, "RULE-CVE-2025-1455-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:_elementor_data", "type": "contains", "value": "wpr-woo-grid"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:popup_notification_animation|popup_notification_fade_out_in|popup_notification_animation_duration|element_open_links_in_new_tab)~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:\\\\\\"|")(?:\\\\s)*(?:on[a-z]{3,20}\\\\s*=|>[^<]{0,200}<\\\\s*(?:script|svg|img|iframe)\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1455", "description": "Royal Elementor Addons <=1.7.1012 Stored XSS via Woo Grid widget in _elementor_data on classic editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.7.1012"}, "RULE-CVE-2025-14552-01": {"ajax_action": "mpp_update_gallery_details", "conditions": [{"name": "ARGS:mpp-gallery-title", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:on\\\\w+\\\\s*=|javascript:|src\\\\s*=|href\\\\s*=)|<\\\\s*(?:script|svg|img|iframe|object|embed|link|style|body|marquee|details|math|video|audio|base)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14552", "description": "MediaPress <=1.6.1 Stored XSS via mpp-gallery-title in mpp_update_gallery_details AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mediapress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.6.1"}, "RULE-CVE-2025-14552-02": {"ajax_action": "mpp_update_gallery_details", "conditions": [{"name": "ARGS:mpp-gallery-description", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:on\\\\w+\\\\s*=|javascript:|src\\\\s*=|href\\\\s*=)|<\\\\s*(?:script|svg|img|iframe|object|embed|link|style|body|marquee|details|math|video|audio|base)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14552", "description": "MediaPress <=1.6.1 Stored XSS via mpp-gallery-description in mpp_update_gallery_details AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mediapress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.6.1"}, "RULE-CVE-2025-14554-01": {"ajax_action": "orderform_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[a-z/!?]~i"}], "cve": "CVE-2025-14554", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14554", "description": "Sell BTC - Cryptocurrency Selling Calculator <=1.5 unauthenticated stored XSS via orderform_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "sell-btc-by-hayyatapps", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-14555-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpdevart_countdown\\\\b[^\\\\]]*(?:]|[\'\\"]javascript\\\\s*:|on(?:error|load|click|mouseover|focus|mouse(?:over|out|enter|move))\\\\s*[=|]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1458", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1458", "description": "Element Pack Addons for Elementor <=5.10.29 Stored XSS via Elementor widget settings in post editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "elementor-addon"], "target": "plugin", "versions": "<=5.10.29"}, "RULE-CVE-2025-1459-01": {"ajax_action": "so_panels_builder_content", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|]*\\\\bon|]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in builder content preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-1459-02": {"ajax_action": "so_panels_builder_content_json", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|]*\\\\bon|]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in builder content JSON preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-1459-03": {"ajax_action": "so_panels_live_editor_preview", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|]*\\\\bon|]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in live editor preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-14610-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"csv_url\\"\\\\s*:\\\\s*\\"\\\\s*(?:(?:file|gopher|dict|ftp|ldap):|https?://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-14610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14610", "description": "TableMaster for Elementor <=1.3.6 SSRF via csv_url parameter in Data Table widget settings", "method": "POST", "mode": "block", "severity": 7.2, "slug": "tablemaster-for-elementor", "tags": ["ssrf", "server-side-request-forgery", "elementor-widget"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-14610-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"json_url\\"\\\\s*:\\\\s*\\"\\\\s*(?:(?:file|gopher|dict|ftp|ldap):|https?://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-14610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14610", "description": "TableMaster for Elementor <=1.3.6 SSRF via json_url parameter in Data Table widget settings", "method": "POST", "mode": "block", "severity": 7.2, "slug": "tablemaster-for-elementor", "tags": ["ssrf", "server-side-request-forgery", "elementor-widget"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-14627-01": {"ajax_action": "get_csv_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://(?:localhost|127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0\\\\.0\\\\.0\\\\.0|\\\\[::1\\\\]|\\\\[f[cd])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14627", "description": "WP Ultimate CSV Importer <=7.35 SSRF via get_csv_url AJAX action - direct internal/private IP in url parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-ultimate-csv-importer", "tags": ["ssrf", "server-side-request-forgery", "internal-network-access"], "target": "plugin", "versions": "<=7.35"}, "RULE-CVE-2025-14627-02": {"ajax_action": "get_csv_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://bit\\\\.ly/~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14627", "description": "WP Ultimate CSV Importer <=7.35 SSRF via get_csv_url AJAX action - bit.ly redirect bypass to internal endpoints", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-ultimate-csv-importer", "tags": ["ssrf", "server-side-request-forgery", "redirect-bypass"], "target": "plugin", "versions": "<=7.35"}, "RULE-CVE-2025-14632-01": {"ajax_action": "upload_file", "conditions": [{"name": "ARGS:_chunkedd", "type": "regex", "value": "~\\\\.html?(?:[\\"\'\\\\s,}]|$)~i"}], "cve": "CVE-2025-14632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14632", "description": "Filr - Secure document library <=1.2.11 stored XSS via HTML file upload through chunked upload path (_chunkedd parameter)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "filr-protection", "tags": ["file-upload", "xss", "dangerous-file-type"], "target": "plugin", "versions": "<=1.2.11"}, "RULE-CVE-2025-14635-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/post.php"}, {"name": "ARGS:ha_page_custom_js", "type": "detectXSS"}], "cve": "CVE-2025-14635", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "target": "plugin", "versions": "<=3.20.3"}, "RULE-CVE-2025-14657-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v1/[^/]+/settings(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14657", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-event-solution", "target": "plugin", "versions": "<=4.0.51"}, "RULE-CVE-2025-14718-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow creation REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow update REST endpoint", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow deletion REST endpoint", "method": "DELETE", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+/publish(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow publish REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14720-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~refund~i"}, {"name": "ARGS", "type": "regex", "value": "~payment_id~i"}], "cve": "CVE-2025-14720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14720", "description": "Amelia Booking <=2.0 unauthenticated Square refund webhook forgery via missing signature verification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "ameliabooking", "tags": ["missing-authorization", "business-logic-abuse", "unauthenticated", "webhook-forgery"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14732-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/[0-9]+(?:[/?]|$)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14732", "description": "Elementor <=3.35.5 stored XSS via REST API meta _elementor_data field", "mode": "block", "severity": 6.4, "slug": "elementor", "tags": ["stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.35.5"}, "RULE-CVE-2025-14736-01": {"ajax_action": "frontend_admin/form_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:administrator|editor)$~i"}], "cve": "CVE-2025-14736", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.28.25"}, "RULE-CVE-2025-14736-02": {"ajax_action": "frontend_admin/validate_form_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:administrator|editor)$~i"}], "cve": "CVE-2025-14736", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.28.25"}, "RULE-CVE-2025-14736-03": {"ajax_action": "frontend_admin/forms/update_field", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:administrator|editor)$~i"}], "cve": "CVE-2025-14736", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.28.25"}, "RULE-CVE-2025-14745-01": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:|]*/?\\\\s*>|]+src\\\\s*=\\\\s*[\'\\"]\\\\s*[xX]|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized template parameter in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14745-02": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:className", "type": "regex", "value": "~(?:[\\"\'][\\\\s>]|<[a-z]+[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized className parameter in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14745-03": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:/^(?:source|sources|feeds|exclude|category|folders)$/", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:|]*/?\\\\s*>|]+src\\\\s*=\\\\s*[\'\\"]\\\\s*[xX]|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized source/sources/feeds/exclude/category/folders parameters in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-1475-01": {"ajax_action": "wpcom_login", "conditions": [{"name": "ARGS:user_phone", "type": "exists"}], "cve": "CVE-2025-1475", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "target": "plugin", "versions": "<=1.7.5"}, "RULE-CVE-2025-14757-01": {"ajax_action": "complete_payment", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14757", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14757", "description": "Cost Calculator Builder <=3.6.9 missing authorization on complete_payment AJAX action allows unauthenticated order status manipulation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "cost-calculator-builder", "tags": ["missing-authorization", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-14770-01": {"action": "init", "conditions": [{"name": "ARGS:shipping_city", "type": "detectSQLi"}], "cve": "CVE-2025-14770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14770", "description": "Shipping Rate By Cities <=2.0.0 unauthenticated SQL injection via shipping_city parameter during WooCommerce checkout", "method": "POST", "mode": "block", "severity": 7.5, "slug": "shipping-rate-by-cities", "tags": ["sql-injection", "unauthenticated", "woocommerce-checkout"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-14770-02": {"action": "init", "conditions": [{"name": "ARGS:billing_city", "type": "detectSQLi"}], "cve": "CVE-2025-14770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14770", "description": "Shipping Rate By Cities <=2.0.0 unauthenticated SQL injection via billing_city parameter during WooCommerce checkout", "method": "POST", "mode": "block", "severity": 7.5, "slug": "shipping-rate-by-cities", "tags": ["sql-injection", "unauthenticated", "woocommerce-checkout"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-14785-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "seedprod_lite_save_lpage"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14785", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14785", "description": "Website Builder by SeedProd (coming-soon) <=6.20.2 contributor+ stored XSS via seedprodnestedmenuwidget shortcode attributes saved through seedprod_lite_save_lpage", "method": "POST", "mode": "block", "severity": 6.4, "slug": "coming-soon", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.20.2"}, "RULE-CVE-2025-14785-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "seedprod_lite_save_template"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14785", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14785", "description": "Website Builder by SeedProd (coming-soon) <=6.20.2 contributor+ stored XSS via seedprodnestedmenuwidget shortcode attributes saved through seedprod_lite_save_template", "method": "POST", "mode": "block", "severity": 6.4, "slug": "coming-soon", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.20.2"}, "RULE-CVE-2025-14793-01": {"action": "init", "conditions": [{"name": "ARGS:dkpdfg", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14793", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14793", "description": "DK PDF <=2.3.0 authenticated (Author+) SSRF via PDF generation trigger (dkpdfg parameter)", "method": "GET", "mode": "block", "severity": 5.0, "slug": "dk-pdf", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2025-14796-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "attachment"}, {"name": "ARGS:post_title", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|details|marquee|object|embed|video|audio|body|input|form|link|meta|style|base|math|a\\\\b)[^>]*(?:\\\\bon\\\\w+\\\\s*=|javascript:|data:\\\\s*text/html)|<\\\\s*script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14796", "description": "My Album Gallery <=1.0.4 Stored XSS via image title in WordPress core post.php attachment edit", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "unpatched"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14796-02": {"ajax_action": "save-attachment", "conditions": [{"name": "ARGS:changes[title]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|details|marquee|object|embed|video|audio|body|input|form|link|meta|style|base|math|a\\\\b)[^>]*(?:\\\\bon\\\\w+\\\\s*=|javascript:|data:\\\\s*text/html)|<\\\\s*script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14796", "description": "My Album Gallery <=1.0.4 Stored XSS via image title in WordPress core save-attachment AJAX", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "unpatched"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14797-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:tag-name", "type": "regex", "value": "~<\\\\s*(?:script|img|svg|iframe|object|embed|details|body|video|audio|marquee|math|base|form|input|button|select|textarea|link|style|meta|applet)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|toggle|resize|scroll|drag|drop|abort|animat|begin|end|input|invalid|key|mouse|pointer|touch|transition|wheel)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-14797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14797", "description": "Same Category Posts <=1.1.19 Stored XSS via taxonomy term creation (tag-name) in widget title placeholder", "method": "POST", "mode": "block", "severity": 5.4, "slug": "same-category-posts", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.19"}, "RULE-CVE-2025-14797-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editedtag"}, {"name": "ARGS:name", "type": "regex", "value": "~<\\\\s*(?:script|img|svg|iframe|object|embed|details|body|video|audio|marquee|math|base|form|input|button|select|textarea|link|style|meta|applet)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|toggle|resize|scroll|drag|drop|abort|animat|begin|end|input|invalid|key|mouse|pointer|touch|transition|wheel)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-14797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14797", "description": "Same Category Posts <=1.1.19 Stored XSS via taxonomy term edit (name) in widget title placeholder", "method": "POST", "mode": "block", "severity": 5.4, "slug": "same-category-posts", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.19"}, "RULE-CVE-2025-14799-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mailin/v1/mailin_disconnect(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14799", "description": "Brevo (Mailin) <=3.3.0 unauthenticated authorization bypass via type juggling on mailin_disconnect REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "mailin", "tags": ["authorization-bypass", "type-juggling", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.3.0"}, "RULE-CVE-2025-14800-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-json/wpcf7r/v1/download-file(/|\\\\?|$)~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(^|.*/)(wp-config\\\\.php|php\\\\.ini|\\\\.htaccess|\\\\.user\\\\.ini)(\\\\?.*)?$~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(^|.*/)([^/]+\\\\.(php[0-9]?|phtml|phar|pht|cgi|exe|sh|jsp|asp|aspx))(\\\\?.*)?$~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(\\\\.\\\\./|\\\\.\\\\./|\\\\.\\\\.\\\\\\\\|%2e%2e%2f|%2e%2e/|/etc/passwd|/windows/win\\\\.ini)~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~^(https?|ftp)://[^\\\\s]+\\\\.(php[0-9]?|phtml|phar|pht|cgi|exe|sh|jsp|asp|aspx)(\\\\?.*)?$~i"}], "cve": "CVE-2025-14800", "method": "GET", "mode": "block", "severity": 8.1, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-14803-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "nf_update_record"}, {"name": "ARGS", "type": "regex", "value": "~(<|%3[cC]|<|�*60;?|�*3[cC];?)\\\\s*(script|img|svg|iframe|object|embed|body|input|details|marquee|div|style|link|base|form|video|audio|math|table|meta|select|textarea|button|isindex|keygen|source|template|noscript|a[\\\\s/>=])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14803", "description": "NEX-Forms <= 9.1.7 authenticated stored XSS via nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=9.1.7"}, "RULE-CVE-2025-14803-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "nf_insert_record"}, {"name": "ARGS", "type": "regex", "value": "~(<|%3[cC]|<|�*60;?|�*3[cC];?)\\\\s*(script|img|svg|iframe|object|embed|body|input|details|marquee|div|style|link|base|form|video|audio|math|table|meta|select|textarea|button|isindex|keygen|source|template|noscript|a[\\\\s/>=])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14803", "description": "NEX-Forms <= 9.1.7 authenticated stored XSS via nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=9.1.7"}, "RULE-CVE-2025-14804-01": {"ajax_action": "wpfm_delete_file", "conditions": [{"name": "ARGS:file_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14804", "description": "Frontend File Manager <=23.4 authenticated arbitrary file deletion via wpfm_delete_file AJAX action (IDOR, no ownership check)", "method": "POST", "mode": "block", "severity": 7.7, "slug": "nmedia-user-file-uploader", "tags": ["missing-authorization", "arbitrary-file-deletion", "idor"], "target": "plugin", "versions": "<=23.4"}, "RULE-CVE-2025-14804-02": {"ajax_action": "wpfm_save_file_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14804", "description": "Frontend File Manager <=23.4 authenticated arbitrary file deletion via wpfm_save_file_data path traversal in filename", "method": "POST", "mode": "block", "severity": 7.7, "slug": "nmedia-user-file-uploader", "tags": ["path-traversal", "arbitrary-file-deletion", "file-name-manipulation"], "target": "plugin", "versions": "<=23.4"}, "RULE-CVE-2025-14842-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\.(?:phar|svg)(?:\\\\s|$)~i"}], "cve": "CVE-2025-14842", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14842", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.2 \\u2013 best-effort block of .phar/.svg strings in POST/GET params on upload AJAX (NOTE: does not inspect multipart filenames in $_FILES; partial coverage only)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["dangerous-file-upload", "unauthenticated", "cwe-434", "partial-coverage"], "target": "plugin", "versions": "<=1.3.9.2"}, "RULE-CVE-2025-14844-01": {"ajax_action": "rcp_stripe_create_setup_intent_for_saved_card", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-14844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14844", "description": "Restrict Content <=3.2.16 unauthenticated Stripe SetupIntent client_secret leak via rcp_stripe_create_setup_intent_for_saved_card AJAX action (IDOR/Missing Auth)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "restrict-content", "tags": ["missing-authentication", "idor", "sensitive-data-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.2.16"}, "RULE-CVE-2025-14855-02": {"ajax_action": "validation_ajax_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|math|details|embed|object)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|pointer[a-z]*)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-14855", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14855", "description": "SureForms <=2.2.0 unauthenticated stored XSS via validation AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "sureforms", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2025-14865-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:content_protector|passster)[^\\\\]]*headline\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z][^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14865", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14865", "description": "Passster \\u2013 Password Protect Pages and Content <=4.2.24 Stored XSS via content_protector/passster shortcode headline attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-protector", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.24"}, "RULE-CVE-2025-14865-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:content_protector|passster)[^\\\\]]*acf\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z][^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script|\\"\\\\s+\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14865", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14865", "description": "Passster \\u2013 Password Protect Pages and Content <=4.2.24 Stored XSS via content_protector/passster shortcode acf attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-protector", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.24"}, "RULE-CVE-2025-14867-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[flashcard[^\\\\]]*source\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|file://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14867", "description": "Flashcard Plugin for WordPress <=0.9 authenticated (Contributor+) arbitrary file read via path traversal in post_content shortcode source attribute", "method": "POST", "mode": "block", "severity": 6.5, "slug": "flashcard", "tags": ["path-traversal", "arbitrary-file-read", "shortcode"], "target": "plugin", "versions": "<=0.9"}, "RULE-CVE-2025-14867-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[flashcard[^\\\\]]*source\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|file://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14867", "description": "Flashcard Plugin for WordPress <=0.9 authenticated (Contributor+) arbitrary file read via REST API post creation with path traversal in content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "flashcard", "tags": ["path-traversal", "arbitrary-file-read", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.9"}, "RULE-CVE-2025-14875-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "equals", "value": "hblpay_return"}, {"name": "ARGS:cusdata", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-14875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14875", "description": "HBLPAY Payment Gateway for WooCommerce <=5.0.0 reflected XSS via cusdata parameter on wc-api callback", "method": "GET", "mode": "block", "severity": 6.1, "slug": "hblpay-payment-gateway-for-woocommerce", "tags": ["xss", "reflected-xss", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-14875-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~hblpay-payment-gateway-for-woocommerce/return\\\\.php~"}, {"name": "ARGS:cusdata", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14875", "description": "HBLPAY Payment Gateway for WooCommerce <=5.0.0 reflected XSS via cusdata parameter on direct return.php access", "method": "GET", "mode": "block", "severity": 6.1, "slug": "hblpay-payment-gateway-for-woocommerce", "tags": ["xss", "reflected-xss", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-1489-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[appbox\\\\b[^\\\\]]*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-1489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1489", "description": "WP-Appbox <=4.5.4 Stored XSS via [appbox] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-appbox", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-1489-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[appbox\\\\b[^\\\\]]*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-1489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1489", "description": "WP-Appbox <=4.5.4 Stored XSS via [appbox] shortcode attributes in post_content param (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-appbox", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-14891-01": {"ajax_action": "cr_local_forms_submit", "conditions": [{"name": "ARGS:displayName", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14891", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14891", "description": "Customer Reviews for WooCommerce <=5.93.1 Stored XSS via displayName in cr_local_forms_submit AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.93.1"}, "RULE-CVE-2025-14893-01": {"action": "init", "conditions": [{"name": "ARGS:tel", "type": "regex", "value": "~<[a-zA-Z/!]~"}], "cve": "CVE-2025-14893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14893", "description": "IndieWeb <=4.0.5 Stored XSS via Telephone profile field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "indieweb", "tags": ["xss", "stored-xss", "user-profile"], "target": "plugin", "versions": "<=4.0.5"}, "RULE-CVE-2025-1490-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "smart-maintenance-mode"}, {"name": "ARGS:setstatus", "type": "detectXSS"}], "cve": "CVE-2025-1490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1490", "description": "Smart Maintenance Mode <=1.5.2 reflected XSS via setstatus parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "smart-maintenance-mode", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-14937-01": {"ajax_action": "frontend_admin/forms/update_field", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:load|error|click|mouseover|focus|blur|mouseout|mousemove|mouseenter|dblclick|keydown|keyup|change|submit|reset|select|abort)\\\\s*=|\\\\b(?:href|src|data|action)\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-14937", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14937", "description": "Frontend Admin by DynamiApps <=3.28.23 unauthenticated stored XSS via acff parameter in update_field AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.28.23"}, "RULE-CVE-2025-14948-01": {"ajax_action": "mo_wc_notification_enable", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:notification", "type": "exists"}], "cve": "CVE-2025-14948", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14948", "description": "OTP Verification & SMS Notification <=4.3.8 missing authorization on mo_wc_notification_enable AJAX action allows unauthenticated notification settings toggle", "method": "POST", "mode": "block", "severity": 5.3, "slug": "miniorange-sms-order-notification-otp-verification", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.8"}, "RULE-CVE-2025-14973-01": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[0][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[0][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14973-02": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[1][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[1][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14973-03": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[2][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[2][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14975-02": {"action": "wp_loaded", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rp"}, {"name": "ARGS:pass1", "type": "exists"}, {"name": "ARGS:rp_key", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-14975", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14975", "description": "Login Customizer <=2.5.3 unauthenticated arbitrary password reset via rp action", "method": "POST", "mode": "block", "severity": 8.1, "slug": "login-customizer", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "password-reset"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-14976-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^user-registration~"}, {"name": "ARGS:action", "type": "equals", "value": "delete"}, {"name": "ARGS:post", "type": "regex", "value": "~^\\\\d+$~"}], "cve": "CVE-2025-14976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14976", "description": "User Registration & Membership <=4.4.8 CSRF to arbitrary post deletion via process_row_actions delete action", "method": "GET", "mode": "block", "severity": 5.4, "slug": "user-registration", "tags": ["csrf", "arbitrary-post-deletion", "missing-nonce"], "target": "plugin", "versions": "<=4.4.8"}, "RULE-CVE-2025-14977-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/dokan/v1/settings(?:/|\\\\?|&|$)~"}, {"name": "ARGS:store_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14977", "description": "Dokan Lite <=4.2.4 IDOR via REST API dokan/v1/settings allows authenticated users to read other vendors\' store settings", "method": "GET", "mode": "block", "severity": 8.1, "slug": "dokan-lite", "tags": ["idor", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-14977-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/dokan/v1/settings(?:/|\\\\?|&|$)~"}, {"name": "ARGS:store_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14977", "description": "Dokan Lite <=4.2.4 IDOR via REST API dokan/v1/settings allows authenticated users to modify other vendors\' store settings including payment info", "method": "POST", "mode": "block", "severity": 8.1, "slug": "dokan-lite", "tags": ["idor", "broken-access-control", "rest-api", "account-takeover"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-14983-01": {"ajax_action": "ACFFA_delete_icon_set", "conditions": [{"name": "ARGS:icon_set_name", "type": "regex", "value": "~<[^>]*(?:script|img|svg|iframe|object|embed|link|style|form|input|body|meta|marquee|details|math|isindex|base|area)|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseenter|mouseleave|mouseout|mousemove|dblclick|contextmenu|wheel|pointerover|animationend|toggle|resize|beforeunload)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html~i"}], "cve": "CVE-2025-14983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14983", "description": "Advanced Custom Fields: Font Awesome <=5.0.1 Stored XSS via ACFFA_delete_icon_set icon_set_name parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-font-awesome", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2025-14985-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~~i"}], "cve": "CVE-2025-14985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14985", "description": "Alpha Blocks <=1.5.0 Authenticated (Contributor+) Stored XSS via alpha_block_css post meta on REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "alpha-blocks", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-14985-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~~i"}], "cve": "CVE-2025-14985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14985", "description": "Alpha Blocks <=1.5.0 Authenticated (Contributor+) Stored XSS via alpha_block_css post meta on REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "alpha-blocks", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-14997-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/members/.+/profile/edit/)~"}, {"name": "ARGS:/^field_\\\\d+$/", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-14997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14997", "description": "BuddyPress Xprofile Custom Field Types <=1.2.8 path traversal payload injection via xprofile field value during BuddyPress profile save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "bp-xprofile-custom-field-types", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-14997-02": {"ajax_action": "bpxcftr_remove_user_tag", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14997", "description": "BuddyPress Xprofile Custom Field Types <=1.2.8 missing authorization on bpxcftr_remove_user_tag AJAX action (defense-in-depth)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "bp-xprofile-custom-field-types", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-14998-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:rp|resetpass)$~i"}, {"name": "ARGS:password_1", "type": "exists"}], "cve": "CVE-2025-14998", "method": "POST", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<3.4.29"}, "RULE-CVE-2025-14998-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-activate\\\\.php~"}, {"name": "ARGS:password_1", "type": "exists"}], "cve": "CVE-2025-14998", "method": "POST", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<3.4.29"}, "RULE-CVE-2025-15019-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:bialty_cs_alt", "type": "regex", "value": "~(?:]|]|on(?:error|load|mouseover|click|focus|blur|input|change|submit|keyup|keydown)\\\\s*=)~i"}], "cve": "CVE-2025-15019", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15019", "description": "BIALTY - Bulk Image Alt Text with Yoast SEO + WooCommerce <=2.2.1 authenticated stored XSS via bialty_cs_alt post meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bulk-image-alt-text-with-yoast", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-1502-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "download_ip2location_redirection_backup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1502", "description": "IP2Location Redirection <=1.33.3 unauthenticated settings export via download_ip2location_redirection_backup action in admin_init", "method": "POST", "mode": "block", "severity": 5.3, "slug": "ip2location-redirection", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.33.3"}, "RULE-CVE-2025-15027-01": {"ajax_action": "jay_login_register_ajax_create_final_user", "conditions": [{"name": "ARGS:meta_wp_capabilities", "type": "exists"}], "cve": "CVE-2025-15027", "method": "POST", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-15027-02": {"ajax_action": "jay_login_register_ajax_create_final_user", "conditions": [{"name": "ARGS:meta_wp_user_level", "type": "exists"}], "cve": "CVE-2025-15027", "method": "POST", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-1503-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][name]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe Name field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-02": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][link]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe link field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-03": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][credit]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe credit field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-04": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][button]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe button field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-05": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][image_url]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe image_url field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-15030-01": {"action": "init", "conditions": [{"name": "ARGS:passw1", "type": "exists"}, {"name": "ARGS:passw2", "type": "exists"}, {"name": "ARGS:loginName", "type": "exists"}, {"name": "ARGS:key", "type": "exists"}, {"name": "ARGS:finalAction", "type": "equals", "value": "yes"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15030", "description": "Profile Builder <=3.15.1 unauthenticated account takeover via password reset bypass", "method": "POST", "mode": "block", "severity": 9.8, "slug": "profile-builder", "tags": ["authentication-bypass", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=3.15.1"}, "RULE-CVE-2025-15041-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/backwpup/v1/save_site_option(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15041", "method": "POST", "mode": "block", "severity": 7.2, "slug": "backwpup", "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2025-15057-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS:fh", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-15057", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15057", "description": "SlimStat Analytics <=5.3.3 unauthenticated stored XSS via fh parameter in slimtrack AJAX handler", "mode": "block", "severity": 7.2, "slug": "wp-slimstat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.3.3"}, "RULE-CVE-2025-15058-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "pricing_table"}, {"name": "ARGS:table_currency", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-15058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15058", "description": "Responsive Pricing Table <=5.1.12 authenticated (Contributor+) Stored XSS via table_currency parameter in pricing_table CPT", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dk-pricr-responsive-pricing-table", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=5.1.12"}, "RULE-CVE-2025-1507-01": {"action": "init", "conditions": [{"name": "ARGS:ga_action", "type": "regex", "value": "~^ga_action_(auth|sharethis_invite|update_terms|enable_all_features|disable_all_features)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1507", "description": "ShareThis Dashboard for Google Analytics <=3.2.1 missing authorization on handle_actions() allows unauthenticated feature deactivation", "mode": "block", "severity": 5.3, "slug": "googleanalytics", "tags": ["missing-authorization", "unauthenticated", "feature-deactivation"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-15100-01": {"ajax_action": "jay_login_register_create_final_user", "conditions": [{"name": "ARGS:/(?i)^meta_(wp_.*|session_tokens.*)/", "type": "exists"}], "cve": "CVE-2025-15100", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-15100-03": {"ajax_action": "jay_panel_update_profile", "conditions": [{"name": "ARGS:/(?i)^jay_panel_meta_(wp_.*|session_tokens.*)/", "type": "exists"}], "cve": "CVE-2025-15100", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-1511-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ur-member~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-1511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1511", "description": "User Registration & Membership <=4.0.4 Reflected XSS via search parameter on membership admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.0.4"}, "RULE-CVE-2025-1513-01": {"ajax_action": "post_cg_set_comment_v10", "conditions": [{"name": "ARGS:Name", "type": "detectXSS"}], "cve": "CVE-2025-1513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1513", "description": "Contest Gallery <=26.0.0.1 unauthenticated stored XSS via Name field in comment submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=26.0.0.1"}, "RULE-CVE-2025-1513-02": {"ajax_action": "post_cg_set_comment_v10", "conditions": [{"name": "ARGS:Comment", "type": "detectXSS"}], "cve": "CVE-2025-1513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1513", "description": "Contest Gallery <=26.0.0.1 unauthenticated stored XSS via Comment field in comment submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=26.0.0.1"}, "RULE-CVE-2025-15260-01": {"ajax_action": "lws_adminpanel_editlist", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15260", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15260", "description": "MyRewards \\u2013 Loyalty Points and Rewards for WooCommerce <=5.6.0 missing authorization on lws_adminpanel_editlist allowing subscriber+ to modify loyalty rules", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woorewards", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2025-15266-01": {"ajax_action": "geekybot_frontendajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-15266", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15266", "description": "GeekyBot <=1.1.8 unauthenticated stored XSS via geekybot_frontendajax chat message", "method": "POST", "mode": "block", "severity": 7.2, "slug": "geeky-bot", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-15266-02": {"ajax_action": "geekybot_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-15266", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15266", "description": "GeekyBot <=1.1.8 unauthenticated stored XSS via geekybot_ajax chat handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "geeky-bot", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-1527-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Classic Editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-1527-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Gutenberg REST API post update", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss", "rest-api"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-1527-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:save_builder|elementor_ajax)$~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss", "elementor"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-15283-01": {"action": "init", "conditions": [{"name": "ARGS:name_directory_name", "type": "exists"}, {"name": "ARGS:name_directory_name", "type": "regex", "value": "~(?:<|<?|�*60;?|�*3[cC];?)(?:script|svg|iframe|img|body|marquee|object|embed|video|audio|details|math)(?:[\\\\s/>]|>?|�*62;?|�*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|�*106;?avascript\\\\s*:|�*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_name parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15283-02": {"action": "init", "conditions": [{"name": "ARGS:name_directory_description", "type": "exists"}, {"name": "ARGS:name_directory_description", "type": "regex", "value": "~(?:<|<?|�*60;?|�*3[cC];?)(?:script|svg|iframe|body|marquee|object|embed|math)(?:[\\\\s/>]|>?|�*62;?|�*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|�*106;?avascript\\\\s*:|�*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_description parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15283-03": {"action": "init", "conditions": [{"name": "ARGS:name_directory_submitter", "type": "exists"}, {"name": "ARGS:name_directory_submitter", "type": "regex", "value": "~(?:<|<?|�*60;?|�*3[cC];?)(?:script|svg|iframe|img|body|marquee|object|embed|video|audio|details|math)(?:[\\\\s/>]|>?|�*62;?|�*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|�*106;?avascript\\\\s*:|�*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_submitter parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15285-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post creation via REST API", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post modification via REST API", "method": "PUT", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post deletion via REST API", "method": "DELETE", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-deletion"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/category(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated category creation via REST API", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15347-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/settings(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15347", "method": "POST", "mode": "block", "severity": 8.8, "slug": "creatorlms", "target": "plugin", "versions": "<=1.1.12"}, "RULE-CVE-2025-15368-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~template\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|phar|zip|glob|file)://|[\\\\\\\\/]etc[\\\\\\\\/])~i"}], "cve": "CVE-2025-15368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15368", "description": "SportsPress <=2.7.26 authenticated local file inclusion via shortcode template attribute in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sportspress", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.7.26"}, "RULE-CVE-2025-15368-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~template\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|phar|zip|glob|file)://|[\\\\\\\\/]etc[\\\\\\\\/])~i"}], "cve": "CVE-2025-15368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15368", "description": "SportsPress <=2.7.26 authenticated local file inclusion via shortcode template attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sportspress", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.7.26"}, "RULE-CVE-2025-15386-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via comment with inline event handler in anchor tag", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~]*href\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via comment with javascript URI in anchor href", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/comments(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via REST API comment with inline event handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/comments(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~]*href\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via REST API comment with javascript URI", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15396-01": {"action": "init", "conditions": [{"name": "ARGS:library-viewer-error-message", "type": "detectXSS"}], "cve": "CVE-2025-15396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15396", "description": "Library Viewer <3.2.0 reflected XSS via library-viewer-error-message GET parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "library-viewer", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<3.2.0"}, "RULE-CVE-2025-15396-02": {"action": "init", "conditions": [{"name": "ARGS:library-viewer-success-message", "type": "detectXSS"}], "cve": "CVE-2025-15396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15396", "description": "Library Viewer <3.2.0 reflected XSS via library-viewer-success-message GET parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "library-viewer", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<3.2.0"}, "RULE-CVE-2025-15403-01": {"ajax_action": "rm_user_exists", "conditions": [{"name": "ARGS:admin_order", "type": "exists"}], "cve": "CVE-2025-15403", "method": "POST", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.7.1"}, "RULE-CVE-2025-15440-02": {"ajax_action": "custom_form_submit", "conditions": [{"name": "ARGS:product_image", "type": "regex", "value": "~(?:^\\\\s*(?:javascript|data|vbscript)\\\\s*:|\\"\\\\s*(?:on[a-z]+=|>|/\\\\s*>))~i"}], "cve": "CVE-2025-15440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15440", "description": "iONE360 configurator <=2.0.57 unauthenticated stored XSS via product_image attribute injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ione360-configurator", "tags": ["xss", "stored-xss", "unauthenticated", "attribute-injection"], "target": "plugin", "versions": "<=2.0.57"}, "RULE-CVE-2025-15466-01": {"ajax_action": "delete_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on delete_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-02": {"ajax_action": "clone_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on clone_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-03": {"ajax_action": "add_new_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on add_new_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-04": {"ajax_action": "save_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-05": {"ajax_action": "get_gallery_configuration", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on get_gallery_configuration AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-06": {"ajax_action": "get_image_size_url", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on get_image_size_url AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-07": {"ajax_action": "delete_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on delete_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-08": {"ajax_action": "save_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-09": {"ajax_action": "add_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on add_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-10": {"ajax_action": "sort_images", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on sort_images AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-11": {"ajax_action": "assign_filters", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on assign_filters AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-12": {"ajax_action": "toggle_visibility", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on toggle_visibility AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-13": {"ajax_action": "assign_group", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on assign_group AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-14": {"ajax_action": "update_gallery_configuration", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on update_gallery_configuration AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-15": {"ajax_action": "refresh_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on refresh_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-16": {"ajax_action": "save_video", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_video AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15477-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bucketlister\\\\b[^\\\\]]*(?:category|id)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]+)(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|EXEC|DECLARE|CAST|CONVERT|WAITFOR|BENCHMARK|SLEEP|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE)\\\\b|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d|--\\\\s|/\\\\*|#\\\\s|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\b)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|/wp-admin/admin-post\\\\.php)~"}], "cve": "CVE-2025-15477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15477", "description": "The Bucketlister <=0.1.5 SQL injection via shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-bucketlister", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.1.5"}, "RULE-CVE-2025-15477-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bucketlister\\\\b[^\\\\]]*(?:category|id)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]+)(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|EXEC|DECLARE|CAST|CONVERT|WAITFOR|BENCHMARK|SLEEP|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE)\\\\b|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d|--\\\\s|/\\\\*|#\\\\s|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\b)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}], "cve": "CVE-2025-15477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15477", "description": "The Bucketlister <=0.1.5 SQL injection via shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-bucketlister", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=0.1.5"}, "RULE-CVE-2025-15482-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~^chapa_proceed$~i"}, {"name": "ARGS:callback_url", "type": "exists"}, {"name": "ARGS:tx_ref", "type": "exists"}, {"name": "ARGS:amount", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2025-15482", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15482", "description": "Chapa Payment Gateway for WooCommerce <=1.0.3 unauthenticated sensitive information exposure (secret_key) via wc-api=chapa_proceed endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "chapa-payment-gateway-for-woocommerce", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-15521-01": {"ajax_action": "academy/shortcode/password_reset_handler", "cve": "CVE-2025-15521", "method": "POST", "mode": "block", "severity": 9.8, "slug": "academy", "target": "plugin", "versions": "<=3.5.0"}, "RULE-CVE-2025-15522-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[automator_discord_user_mapping\\\\b[^\\\\]]*verified_message\\\\s*=\\\\s*[^\\\\]]*<[^>]+[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-15522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15522", "description": "Uncanny Automator <=6.10.0.2 Stored XSS via automator_discord_user_mapping shortcode verified_message attribute (post save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uncanny-automator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.10.0.2"}, "RULE-CVE-2025-15522-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[automator_discord_user_mapping\\\\b[^\\\\]]*verified_message\\\\s*=\\\\s*[^\\\\]]*<[^>]+[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-15522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15522", "description": "Uncanny Automator <=6.10.0.2 Stored XSS via automator_discord_user_mapping shortcode verified_message attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uncanny-automator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.10.0.2"}, "RULE-CVE-2025-1560-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]wee [^]]*(?:on[a-zA-Z]+=|javascript:|\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via floating-button settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1620-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "moove-gdpr"}, {"name": "ARGS:tab", "type": "equals", "value": "branding"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|object|embed|math)\\\\b|\\\\bon(?:mouse\\\\w+|load|error|focus|blur|click|dblclick|key\\\\w+|change|submit|reset|select|abort|resize)\\\\s*=|javascript\\\\s*:|\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via branding settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1620-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "moove-gdpr"}, {"name": "ARGS:tab", "type": "equals", "value": "banner-settings"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|object|embed|math)\\\\b|\\\\bon(?:mouse\\\\w+|load|error|focus|blur|click|dblclick|key\\\\w+|change|submit|reset|select|abort|resize)\\\\s*=|javascript\\\\s*:|\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via banner-settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1625-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:qi-blocks/counter\\\\s*\\\\{[^}]*(?:]|\\\\bon(?:error|load|mouseover|focus|click)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1625", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1625", "description": "Qi Blocks <1.4 stored XSS via Counter block attributes in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<1.4"}, "RULE-CVE-2025-1625-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:qi-blocks/counter\\\\s*\\\\{[^}]*(?:]|\\\\bon(?:error|load|mouseover|focus|click)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1625", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1625", "description": "Qi Blocks <1.4 stored XSS via Counter block attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<1.4"}, "RULE-CVE-2025-1626-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Countdown block options in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/counter"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Counter block options in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Countdown block options in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/counter"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Counter block options in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1662-01": {"ajax_action": "url_media_uploader_url_upload", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^https?://(?:localhost|\\\\[?::1\\\\]?|0(?:\\\\.0){0,3}|127\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0x[0-9a-f]{8}|[0-9]{8,10})(?:[:/]|$))~i"}], "cve": "CVE-2025-1662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1662", "description": "URL Media Uploader <=1.0.0 authenticated SSRF via url parameter in url_media_uploader_url_upload AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "url-media-uploader", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-1664-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (REST API post create)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1664-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (REST API post update)", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1664-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (classic editor post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "classic-editor"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1670-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpsp-exams"}, {"name": "ARGS:cid", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-1670", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1670", "description": "WPSchoolPress <=2.2.16 authenticated SQL injection via cid parameter on wpsp-exams admin page", "method": "GET", "mode": "block", "severity": 6.5, "slug": "wpschoolpress", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=2.2.16"}, "RULE-CVE-2025-1670-02": {"ajax_action": "GetClass", "conditions": [{"name": "ARGS:cid", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-1670", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1670", "description": "WPSchoolPress <=2.2.16 authenticated SQL injection via cid parameter in GetClass AJAX handler", "mode": "block", "severity": 6.5, "slug": "wpschoolpress", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=2.2.16"}, "RULE-CVE-2025-1670-03": {"ajax_action": "GetClassYear", "conditions": [{"name": "ARGS:cid", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-1670", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1670", "description": "WPSchoolPress <=2.2.16 authenticated SQL injection via cid parameter in GetClassYear AJAX handler", "mode": "block", "severity": 6.5, "slug": "wpschoolpress", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=2.2.16"}, "RULE-CVE-2025-1702-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~\'\\\\s*(?:OR|AND|UNION)\\\\s|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|--\\\\s*$|/\\\\*~i"}], "cve": "CVE-2025-1702", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1702", "description": "Ultimate Member <=2.10.0 unauthenticated SQL injection via search parameter in member directory AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ultimate-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=2.10.0"}, "RULE-CVE-2025-1703-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1703", "description": "Ultimate Blocks <=3.2.7 Stored XSS via content parameter in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1703-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1703", "description": "Ultimate Blocks <=3.2.7 Stored XSS via content parameter in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1717-01": {"action": "init", "conditions": [{"name": "ARGS:lmn", "type": "exists"}], "cve": "CVE-2025-1717", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1717", "description": "Login Me Now <=1.7.2 unauthenticated authentication bypass via transient-based auto-login (lmn parameter)", "method": "GET", "mode": "block", "severity": 8.1, "slug": "login-me-now", "tags": ["authentication-bypass", "unauthenticated", "missing-authentication"], "target": "plugin", "versions": "<=1.7.2"}, "RULE-CVE-2025-1730-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "regex", "value": "~(?:(?:\\\\\\\\.\\\\\\\\.[\\\\\\\\\\\\/]){2,}|^/etc/|wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) arbitrary file read via sdc_download post creation with malicious sdc_download_path", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["arbitrary-file-read", "missing-authorization", "path-traversal"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1730-02": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "regex", "value": "~^(?:file://|php://|expect://|data://|glob://|phar://|ssh2://|ogg://|zlib://|rar://|zip://|ftp://|dict://|gopher://|ldap://|telnet://|smtp://|imap://|pop3://|http://(?:127\\\\.|0\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|localhost|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) SSRF/arbitrary file read via sdc_download post creation with malicious remote URL", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["arbitrary-file-read", "ssrf", "missing-authorization"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1730-03": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) capability bypass - non-admin creating sdc_download posts", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1766-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v2/payment(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1766", "description": "Eventin <=4.0.24 unauthenticated payment status update via REST API /eventin/v2/payment endpoint", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "wp-event-solution", "tags": ["missing-authorization", "unauthenticated", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=4.0.24"}, "RULE-CVE-2025-1766-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v2/payment(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1766", "description": "Eventin <=4.0.24 unauthenticated payment status update via REST API /eventin/v2/payment endpoint (PATCH method)", "method": "PATCH", "mode": "block", "severity": 5.3, "slug": "wp-event-solution", "tags": ["missing-authorization", "unauthenticated", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=4.0.24"}, "RULE-CVE-2025-1768-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^sq_(ajax_)?(assistant|audits|bulkseo|focuspages|onboarding|post|saveseo)$~i"}, {"name": "ARGS:skeyword", "type": "regex", "value": "~\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+UNION(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(?:ALL(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+)?SELECT|\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*(AND|OR)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*[\\\\d(]|\'\\\\s*;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(AND|OR)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(IF|SLEEP|EXTRACTVALUE|BENCHMARK)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*\\\\(~i"}], "cve": "CVE-2025-1768", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1768", "description": "Squirrly SEO <=12.4.05 authenticated blind SQL injection via skeyword parameter in AJAX search handlers", "method": "POST", "mode": "block", "severity": 6.5, "slug": "squirrly-seo", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=12.4.05"}, "RULE-CVE-2025-1783-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-02": {"action": "admin_init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post partial update (PATCH)", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1784-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[\\\\s\\\\S]{0,2000}(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*img\\\\b[^>]*\\\\bonerror\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1784", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.0 Stored XSS via uagb block_id attribute in post content (post.php entrypoint)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.19.0"}, "RULE-CVE-2025-1784-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\\\s\\\\S]{0,2000}(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*img\\\\b[^>]*\\\\bonerror\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1784", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.0 Stored XSS via uagb block_id attribute in post content (REST API entrypoint)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=2.19.0"}, "RULE-CVE-2025-1785-01": {"ajax_action": "wpdm_newfile", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]~"}], "cve": "CVE-2025-1785", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1785", "description": "Download Manager <=3.3.08 authenticated (Author+) path traversal via wpdm_newfile AJAX action allowing limited file overwrite", "method": "POST", "mode": "block", "severity": 8.1, "slug": "download-manager", "tags": ["path-traversal", "file-overwrite", "authenticated"], "target": "plugin", "versions": "<=3.3.08"}, "RULE-CVE-2025-1802-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[\\"\']marker_title[\\"\']\\\\s*[:\\\\,]\\\\s*[\\"\'][^\\"\']*(?:]+onerror|]+onload|]+src\\\\s*=\\\\s*[\\"\']?javascript:|on(?:error|load|click|mouseover|focus|blur|animationend)\\\\s*=)~i"}], "cve": "CVE-2025-1802", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1802", "description": "HT Mega for Elementor <=2.8.3 Stored XSS via Google Map widget marker_title parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ht-mega-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2025-1802-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[\\"\']notification_content[\\"\']\\\\s*[:\\\\,]\\\\s*[\\"\'][^\\"\']*(?:]+onerror|]+onload|]+src\\\\s*=\\\\s*[\\"\']?javascript:|on(?:error|load|click|mouseover|focus|blur|animationend)\\\\s*=)~i"}], "cve": "CVE-2025-1802", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1802", "description": "HT Mega for Elementor <=2.8.3 Stored XSS via Notify widget notification_content parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ht-mega-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2025-1802-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~stt_button_text[\\"\':=\\\\s]+[^}\\"&]*(?:]+onerror|]+onload|]+src\\\\s*=\\\\s*[\\"\']?javascript:|on(?:error|load|click|mouseover|focus|blur|animationend)\\\\s*=)~i"}], "cve": "CVE-2025-1802", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1802", "description": "HT Mega for Elementor <=2.8.3 Stored XSS via Scroll-to-Top stt_button_text parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ht-mega-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2025-1909-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:$|[/?])~i"}, {"name": "ARGS:bb_social_login", "type": "equals", "value": "apple"}], "cve": "CVE-2025-1909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1909", "description": "BuddyBoss Platform Pro <=2.7.01 Apple OAuth authentication bypass (CWE-288) \\u2014 web flow wp-login.php?bb_social_login=apple", "method": "POST", "mode": "block", "severity": 9.8, "slug": "buddyboss-platform-pro", "target": "plugin", "versions": "<=2.7.01"}, "RULE-CVE-2025-1912-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wt_iew_export_download", "type": "exists"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via export download_file admin_init handler", "method": "GET", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1912-02": {"action": "admin_init", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}, {"name": "ARGS:page", "type": "regex", "value": "~^wt-iew-(?:history|export)$~"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via history/export page download_file admin_init handler", "method": "GET", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1912-03": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"name": "ARGS:file_url", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via iew_import_ajax_basic validate_file", "method": "POST", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1971-01": {"ajax_action": "iew_export_ajax_basic", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-1971", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1971", "description": "Export and Import Users and Customers <=2.6.2 PHP Object Injection via form_data in export AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "users-customers-import-export-for-wp-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.6.2"}, "RULE-CVE-2025-1971-02": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-1971", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1971", "description": "Export and Import Users and Customers <=2.6.2 PHP Object Injection via form_data in import AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "users-customers-import-export-for-wp-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.6.2"}, "RULE-CVE-2025-2004-01": {"ajax_action": "wpe_delete_file", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2e%2e[%2f/\\\\\\\\]|%252e%252e%252f)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2004", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2004", "description": "Simple WP Events <=1.8.17 unauthenticated arbitrary file deletion via wpe_delete_file AJAX action", "method": "POST", "mode": "block", "severity": 9.1, "slug": "simple-wp-events", "tags": ["arbitrary-file-deletion", "path-traversal", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.8.17"}, "RULE-CVE-2025-2005-01": {"action": "init", "conditions": [{"name": "ARGS:ewd-feup-action", "type": "equals", "value": "register"}, {"name": "FILES:upload:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|ps|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:\\\\.|$)|[\\\\\\\\/]\\\\.htaccess$~i"}], "cve": "CVE-2025-2005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2005", "description": "Front End Only Users <=3.2.32 unauthenticated arbitrary file upload via registration form", "method": "POST", "mode": "block", "severity": 9.8, "slug": "front-end-only-users", "tags": ["arbitrary-file-upload", "unauthenticated", "rce"], "target": "plugin", "versions": "<=3.2.32"}, "RULE-CVE-2025-2005-02": {"action": "init", "conditions": [{"name": "ARGS:ewd-feup-action", "type": "equals", "value": "update"}, {"name": "FILES:upload:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|ps|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:\\\\.|$)|[\\\\\\\\/]\\\\.htaccess$~i"}], "cve": "CVE-2025-2005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2005", "description": "Front End Only Users <=3.2.32 unauthenticated arbitrary file upload via profile update form", "method": "POST", "mode": "block", "severity": 9.8, "slug": "front-end-only-users", "tags": ["arbitrary-file-upload", "unauthenticated", "rce"], "target": "plugin", "versions": "<=3.2.32"}, "RULE-CVE-2025-2009-01": {"ajax_action": "wpmlsubscribe", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-2009", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2009", "description": "Newsletters <=4.9.9.7 unauthenticated stored XSS via subscriber name field in wpmlsubscribe AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "newsletters-lite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.9.9.7"}, "RULE-CVE-2025-2009-02": {"ajax_action": "wpmlsubscribe", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-2009", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2009", "description": "Newsletters <=4.9.9.7 unauthenticated stored XSS via subscriber email field in wpmlsubscribe AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "newsletters-lite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.9.9.7"}, "RULE-CVE-2025-2025-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-reports"}, {"name": "ARGS:view", "type": "equals", "value": "earnings"}, {"type": "missing_capability", "value": "view_give_reports"}], "cve": "CVE-2025-2025", "method": "GET", "mode": "block", "severity": 7.5, "slug": "give", "target": "plugin", "versions": "<=3.22.0"}, "RULE-CVE-2025-2025-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-reports"}, {"name": "ARGS:tab", "type": "equals", "value": "earnings"}, {"type": "missing_capability", "value": "view_give_reports"}], "cve": "CVE-2025-2025", "method": "GET", "mode": "block", "severity": 7.5, "slug": "give", "target": "plugin", "versions": "<=3.22.0"}, "RULE-CVE-2025-2055-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mappress_maps"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-zA-Z]+=|]|]|javascript\\\\s*:|]*\\\\bon[a-zA-Z]+=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2055", "description": "MapPress Maps for WordPress <=2.94.8 authenticated (Contributor+) stored XSS via map marker fields on admin page", "method": "POST", "mode": "block", "severity": 6.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.94.8"}, "RULE-CVE-2025-2056-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)){2,}~"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via REQUEST_URI in showFile (multi-level traversal)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2056-03": {"action": "init", "conditions": [{"name": "ARGS:hmwp_url", "type": "regex", "value": "~(?:\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)){2,}~"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via hmwp_url parameter (multi-level traversal)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2056-04": {"action": "init", "conditions": [{"name": "ARGS:hmwp_url", "type": "regex", "value": "~\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)~"}, {"name": "ARGS:hmwp_url", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via hmwp_url targeting sensitive files", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2083-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2083-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2083-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in wp-admin post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2109-01": {"action": "init", "conditions": [{"name": "ARGS:css", "type": "regex", "value": "~^(?:https?://|//|ftp://|file://|php://|phar://|data://|expect://|glob://)~i"}], "cve": "CVE-2025-2109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2109", "description": "WP Compress <=6.30.15 unauthenticated SSRF via css query parameter in init hook", "mode": "block", "severity": 5.8, "slug": "wp-compress-image-optimizer", "tags": ["ssrf", "unauthenticated", "file-get-contents"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-01": {"ajax_action": "wps_ic_saveSetting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_saveSetting AJAX handler allows Subscriber+ to modify plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-02": {"ajax_action": "wps_ic_get_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_get_setting AJAX handler allows Subscriber+ to read plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-03": {"ajax_action": "wps_ic_settings_change", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_settings_change AJAX handler allows Subscriber+ to alter plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-04": {"ajax_action": "wpc_ic_checkCFConnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_checkCFConnect AJAX handler allows Subscriber+ to overwrite Cloudflare config", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-05": {"ajax_action": "wpc_ic_checkCFDisconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_checkCFDisconnect AJAX handler allows Subscriber+ to delete Cloudflare config", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-06": {"ajax_action": "wpc_ic_set_mode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_set_mode AJAX handler allows Subscriber+ to change plugin operation mode", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-07": {"ajax_action": "wps_ic_purge_cdn", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_purge_cdn AJAX handler allows Subscriber+ to purge CDN cache", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-08": {"ajax_action": "wps_ic_purge_html", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_purge_html AJAX handler allows Subscriber+ to purge HTML cache", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-09": {"ajax_action": "wpc_ic_start_bulk_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_start_bulk_restore AJAX handler allows Subscriber+ to trigger bulk image restore", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-10": {"ajax_action": "wpc_ic_start_bulk_compress", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_start_bulk_compress AJAX handler allows Subscriber+ to trigger bulk image compression", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-11": {"ajax_action": "wps_ic_save_excludes_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_save_excludes_settings AJAX handler allows Subscriber+ to modify exclude settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-12": {"ajax_action": "wps_lite_connect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_lite_connect AJAX handler allows Subscriber+ to connect plugin to external API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-13": {"ajax_action": "wps_ic_cname_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_cname_add AJAX handler allows Subscriber+ to add CNAME records", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-14": {"ajax_action": "wps_ic_remove_cname", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_remove_cname AJAX handler allows Subscriber+ to remove CNAME records", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-15": {"ajax_action": "wps_ic_remove_key", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_remove_key AJAX handler allows Subscriber+ to remove plugin API key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2111-02": {"action": "admin_init", "conditions": [{"name": "ARGS:set_option_name", "type": "exists"}, {"name": "ARGS:option_value", "type": "exists"}, {"name": "ARGS:page", "type": "equals", "value": "wpb-debug"}], "cve": "CVE-2025-2111", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2111", "description": "WP Headers And Footers <=3.1.1 CSRF to arbitrary options update via debug page POST request (set_option_name/option_value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-headers-and-footers", "tags": ["csrf", "arbitrary-option-update", "privilege-escalation"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-2128-01": {"ajax_action": "ccb_update_order", "conditions": [{"name": "ARGS:order_ids", "type": "regex", "value": "~[^0-9,]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2128", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2128", "description": "Cost Calculator Builder <=3.2.67 authenticated SQL injection via order_ids parameter in Payments::update_payment_status_by_order_ids", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cost-calculator-builder", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=3.2.67"}, "RULE-CVE-2025-2162-01": {"ajax_action": "mapp_options_save", "conditions": [{"name": "ARGS:width", "type": "regex", "value": "~<[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2162", "description": "MapPress Maps for WordPress <=2.94.9 stored XSS via unsanitized width setting in mapp_options_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "settings-injection"], "target": "plugin", "versions": "<=2.94.9"}, "RULE-CVE-2025-2162-02": {"ajax_action": "mapp_options_save", "conditions": [{"name": "ARGS:base_font_size", "type": "regex", "value": "~<[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2162", "description": "MapPress Maps for WordPress <=2.94.9 stored XSS via unsanitized base_font_size setting in mapp_options_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "style-breakout"], "target": "plugin", "versions": "<=2.94.9"}, "RULE-CVE-2025-2164-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:sortby", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via sortby parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via post_id parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:pixelstats_page", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via pixelstats_page parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:last_day", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via last_day parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2166-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^cm-faq($|-)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\'`]\\\\s*>\\\\s*<|<\\\\s*(?:script|svg|img|iframe|object|embed|body|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2166", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2166", "description": "CM FAQ <=1.2.5 Reflected XSS via remove_query_arg without esc_url on admin page URL", "method": "GET", "mode": "block", "severity": 6.1, "slug": "cm-faq", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-2167-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages))~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[events_list\\\\b[^\\\\]]*(?:before_title|title|after_title)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]+\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]+\\\\bontoggle\\\\s*=|javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|toggle)\\\\s*=)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2167", "description": "Event Post <=5.9.9 Stored XSS via events_list shortcode attributes (before_title, title, after_title) in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "event-post", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2025-2186-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bwfan_get_automation_wc_dynamic_coupon"}, {"name": "ARGS:automationId", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-2186", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2186", "description": "FunnelKit Automations <=3.5.1 unauthenticated SQL injection via automationId parameter in bwfan_get_automation_wc_dynamic_coupon AJAX handler", "mode": "block", "severity": 7.5, "slug": "wp-marketing-automations", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-2203-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/funnelkit-app/funnel-analytics/\\\\d+/contacts~"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:\'[\\\\s)]*(?:UNION[\\\\s/\\\\*]+SELECT|OR[\\\\s/\\\\*]+[\'\\"]?\\\\w+[\'\\"]?\\\\s*[=<>]|AND[\\\\s/\\\\*]+[\'\\"]?\\\\w+|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE)|INTO[\\\\s/\\\\*]+(?:OUT|DUMP)FILE|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE|UPDATEXML|LOAD_FILE))~i"}], "cve": "CVE-2025-2203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2203", "description": "FunnelKit Funnel Builder <=3.10.1 authenticated SQL injection via search parameter in funnel analytics contacts REST endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "funnel-builder", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.10.1"}, "RULE-CVE-2025-2221-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_login"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated time-based SQL injection via user_phone parameter in wpcom_login AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_register"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_register AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_send_sms_code"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_send_sms_code AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-04": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_lostpassword"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_lostpassword AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-05": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_resetpassword"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_resetpassword AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-06": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_accountbind"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_accountbind AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2225-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\"rael_title_tag\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<\\\\s*(?:script|img|svg|iframe|body|marquee|details|math|a\\\\b|div\\\\s|input)[^\\"]*|\\\\bon(?:error|load|click|mouseover|focus|toggle|start)\\\\s*=)[^\\"]*\\"~i"}], "cve": "CVE-2025-2225", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2225", "description": "Responsive Addons for Elementor <=1.6.9 Stored XSS via rael_title_tag in Icon Box widget (post.php save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2025-2228-01": {"action": "init", "conditions": [{"name": "ARGS:rael-register-submit", "type": "exists"}, {"name": "ARGS:password", "type": "exists"}, {"name": "ARGS:page_id", "type": "exists"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2025-2228", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2228", "description": "Responsive Addons for Elementor <=1.6.8 sensitive information exposure via register_user \\u2014 blocks registration form submissions for users lacking create_users capability. NOTE: This also blocks anonymous self-registration on vulnerable versions as a protective measure.", "method": "POST", "mode": "block", "severity": 5.7, "slug": "responsive-addons-for-elementor", "tags": ["sensitive-information-exposure", "credential-leak"], "target": "plugin", "versions": "<=1.6.8"}, "RULE-CVE-2025-22295-01": {"ajax_action": "tripetto_submit", "conditions": [{"name": "ARGS:snapshot", "type": "regex", "value": "~]*>|<[^>]+\\\\son\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-22295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22295", "description": "Tripetto <= 8.0.6 Stored XSS via unauthenticated form submission (tripetto_submit snapshot parameter)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "tripetto", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=8.0.6"}, "RULE-CVE-2025-22295-02": {"ajax_action": "tripetto_pause", "conditions": [{"name": "ARGS:snapshot", "type": "regex", "value": "~]*>|<[^>]+\\\\son\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-22295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22295", "description": "Tripetto <= 8.0.6 Stored XSS via unauthenticated paused form data (tripetto_pause snapshot parameter)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "tripetto", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=8.0.6"}, "RULE-CVE-2025-22317-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpape-gallery-settings"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|focus|blur|click)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:onfocus|onload|onerror|onmouseover|onclick)\\\\s*=)~i"}], "cve": "CVE-2025-22317", "description": "Gallery Images Ape <=2.2.8 reflected XSS via tab parameter on admin settings page", "mode": "block", "severity": 7.1, "slug": "gallery-images-ape", "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2025-22349-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-manage"}, {"name": "ARGS:bid_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via bid_id parameter in wp-auctions-manage admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-22349-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-manage"}, {"name": "ARGS:wpa_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via wpa_id parameter in wp-auctions-manage admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-22349-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-add"}, {"name": "ARGS:wpa_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via wpa_id parameter in wp-auctions-add admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-2252-01": {"ajax_action": "edd_get_download_title", "conditions": [{"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "code_analyst.json:file-GWz1zUnizLcTqJCyFWThCg", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7"], "name": "ARGS:action", "type": "equals", "value": "edd_get_download_title"}, {"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "code_analyst.json:file-GWz1zUnizLcTqJCyFWThCg", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7"], "name": "ARGS:edd_get_download_title", "type": "regex", "value": "~^[0-9]+$~"}, {"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7", "author_report.json:file-S6ZFTyHKyXhYs5pWZxQcgo"], "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2252", "mode": "block", "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.6.1"}, "RULE-CVE-2025-2257-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "boldgrid-backup-settings"}, {"name": "ARGS:compression_level", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-2257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2257", "description": "Total Upkeep \\u2013 BoldGrid Backup <=1.16.10 authenticated OS command injection via compression_level setting", "method": "POST", "mode": "block", "severity": 7.2, "slug": "boldgrid-backup", "tags": ["command-injection", "authenticated", "settings-update"], "target": "plugin", "versions": "<=1.16.10"}, "RULE-CVE-2025-2269-01": {"ajax_action": "editimage_bwg", "conditions": [{"name": "ARGS:image_id", "type": "regex", "value": "~[<>\\"\'()]~"}], "cve": "CVE-2025-2269", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2269", "description": "Photo Gallery by 10Web <=1.8.34 reflected XSS via image_id in editimage_bwg AJAX handler", "mode": "block", "severity": 6.1, "slug": "photo-gallery", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.8.34"}, "RULE-CVE-2025-2270-01": {"action": "init", "conditions": [{"name": "ARGS:ycd_type", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|phar|zip|data|expect|glob|ogg)://)~i"}], "cve": "CVE-2025-2270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2270", "description": "Countdown Builder <=2.8.9.1 unauthenticated Local File Inclusion via ycd_type parameter in RegisterPostType::createCdObj", "mode": "block", "severity": 8.1, "slug": "countdown-builder", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.8.9.1"}, "RULE-CVE-2025-22735-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~]~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via unsanitized $_SERVER[\'REQUEST_URI\'] in admin settings view templates", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22735-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~on(?:error|load|click|focus|mouseover|mouseout|submit|change|input|keydown|keyup)\\\\s*=~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via event handler injection in admin settings pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22735-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~<(?:img|svg|iframe|body|embed|object|video|audio|details|math|marquee)[\\\\s/]~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via HTML tag injection (img/svg/iframe/body/embed/object) in admin settings pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22800-01": {"action": "admin_post_regenerate-qrcode", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "regenerate-qrcode"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-22800", "mode": "block", "severity": 8.8, "slug": "post-smtp", "target": "plugin", "versions": ">=2.8.3 <=2.9.11"}, "RULE-CVE-2025-2299-01": {"ajax_action": "lwptoc_block_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|details|video|audio|body|input|select|textarea|form|meta|link|style|base)\\\\b[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2299", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2299", "description": "LuckyWP Table of Contents <=2.1.10 CSRF to Reflected XSS via lwptoc_block_edit AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "luckywp-table-of-contents", "tags": ["xss", "csrf", "reflected-xss"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-2299-02": {"ajax_action": "lwptoc_block_view", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|details|video|audio|body|input|select|textarea|form|meta|link|style|base)\\\\b[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2299", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2299", "description": "LuckyWP Table of Contents <=2.1.10 CSRF to Reflected XSS via lwptoc_block_view AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "luckywp-table-of-contents", "tags": ["xss", "csrf", "reflected-xss"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-2302-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[aws_search_terms\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2302", "description": "Advanced Woo Search <=3.28 Stored XSS via aws_search_terms shortcode attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-woo-search", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.28"}, "RULE-CVE-2025-2302-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[aws_search_terms\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2302", "description": "Advanced Woo Search <=3.28 Stored XSS via aws_search_terms shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-woo-search", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.28"}, "RULE-CVE-2025-2314-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-logout\\\\b[^\\\\]]*\\\\blink_text\\\\s*=\\\\s*(?:\\"[^\\"]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-logout] link_text shortcode attribute in REST API post/page content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.5"}, "RULE-CVE-2025-2314-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-restrict\\\\b[^\\\\]]*\\\\bmessage\\\\s*=\\\\s*(?:\\"[^\\"]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-restrict] message shortcode attribute in REST API post/page content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.6"}, "RULE-CVE-2025-2314-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-logout\\\\b[^\\\\]]*\\\\blink_text\\\\s*=\\\\s*(?:\\"[^\\"]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-logout] link_text shortcode attribute in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.5"}, "RULE-CVE-2025-2314-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-restrict\\\\b[^\\\\]]*\\\\bmessage\\\\s*=\\\\s*(?:\\"[^\\"]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-restrict] message shortcode attribute in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.6"}, "RULE-CVE-2025-2317-01": {"ajax_action": "woo_product_filter", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\'[) ]*(?:/[*][^*]*[*]/[ ]*)*(?:UNION(?:[ ]+|/[*][^*]*[*]/)(?:ALL(?:[ ]+|/[*][^*]*[*]/))?SELECT|(?:OR|AND)(?:[ ]+|/[*][^*]*[*]/)(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|[0-9]+[ ]*=[ ]*[0-9]))~i"}], "cve": "CVE-2025-2317", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2317", "description": "Product Filter by WBW <=2.7.9 unauthenticated SQL injection via filtersDataBackend parameter in woo_product_filter AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "woo-product-filter", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.7.9"}, "RULE-CVE-2025-2319-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_USER", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_USER parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:db_date", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in db_date parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_NAME", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_NAME parameter used in backup shell commands", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:Download_SQL_Backup", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|\\\\x0d|\\\\x0a)~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to path traversal and header injection via Download_SQL_Backup parameter", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "path-traversal", "header-injection"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_PASSWORD", "type": "regex", "value": "~[;`|\\\\x0a\\\\x0d]|\\\\$\\\\(~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell injection constructs in DB_PASSWORD parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_HOST", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_HOST parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2328-01": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/])+~"}], "cve": "CVE-2025-2328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2328", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.8.7 arbitrary file deletion via path traversal in dnd_codedropz_upload_delete AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=1.3.8.7"}, "RULE-CVE-2025-2328-02": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-2328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2328", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.8.7 arbitrary sensitive file deletion via dnd_codedropz_upload_delete AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=1.3.8.7"}, "RULE-CVE-2025-2330-01": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~button[\\\\-_]modal~i"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur|change|input|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|resize)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2330", "description": "WidgetKit for Elementor <=2.5.4 Stored XSS via button-modal widget in _elementor_data (post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "widgetkit-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-2330-02": {"action": "init", "conditions": [{"name": "ARGS:elements", "type": "regex", "value": "~button[\\\\-_]modal~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur|change|input|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|resize)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2330", "description": "WidgetKit for Elementor <=2.5.4 Stored XSS via button-modal widget in elements param (Elementor AJAX save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "widgetkit-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-23843-01": {"action": "init", "conditions": [{"name": "ARGS:filter_designation", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_designation parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-02": {"action": "init", "conditions": [{"name": "ARGS:filter_department", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_department parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-03": {"action": "init", "conditions": [{"name": "ARGS:filter_employment_type", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_employment_type parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-04": {"action": "init", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via orderby parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-05": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via order parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-06": {"action": "init", "conditions": [{"name": "ARGS:status", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via status parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-07": {"action": "init", "conditions": [{"name": "ARGS:post_mime_type", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via post_mime_type parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-08": {"action": "init", "conditions": [{"name": "ARGS:detached", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via detached parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-09": {"action": "init", "conditions": [{"name": "ARGS:search_employee", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via search_employee parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-10": {"action": "init", "conditions": [{"name": "ARGS:from", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via from parameter in leave holiday views", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-11": {"action": "init", "conditions": [{"name": "ARGS:to", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via to parameter in leave holiday views", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-12": {"action": "init", "conditions": [{"name": "ARGS:filter_duration", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_duration parameter in audit log", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23942-01": {"ajax_action": "wpgallery", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 authenticated arbitrary file upload via wpgallery AJAX action", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["arbitrary-file-upload", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-02": {"ajax_action": "wplg_edit_gallery", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 authenticated arbitrary file upload via wplg_edit_gallery AJAX action", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["arbitrary-file-upload", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-03": {"ajax_action": "wplg_loadmore_gallery", "conditions": [{"name": "ARGS:options", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 unauthenticated local file inclusion via options parameter in wplg_loadmore_gallery", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-04": {"ajax_action": "wplg_navigation_gallery", "conditions": [{"name": "ARGS:gallery_id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 unauthenticated local file inclusion via gallery_id parameter in wplg_navigation_gallery", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-24000-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/post-smtp/v1/logs/[^/]+/resend(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 post-smtp/v1/logs/{id}/resend REST endpoint callable by non-admin users, allowing abuse of password reset emails.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs", "resend"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/email-count(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/email-count REST endpoint accessible to non-admin users.", "method": "GET", "mode": "block", "severity": 6.5, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/minimize-maximize-ad(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/minimize-maximize-ad REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/get-failed-logs(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/get-failed-logs REST endpoint accessible to non-admin users, exposing failed email log contents.", "method": "GET", "mode": "block", "severity": 8.8, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/open-notification(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/open-notification REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-08": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/remove-notification(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/remove-notification REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24563-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:user_name_search", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via user_name_search parameter in author-search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:latitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via latitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:longitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via longitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-04": {"action": "template_redirect", "conditions": [{"name": "ARGS:address_latitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via address_latitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-05": {"action": "template_redirect", "conditions": [{"name": "ARGS:address_longitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via address_longitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-06": {"action": "template_redirect", "conditions": [{"name": "ARGS:dir_id", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via dir_id parameter in claim.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-07": {"action": "template_redirect", "conditions": [{"name": "ARGS:package_id", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via package_id parameter in wizard-style-2.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24573-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur|change|input|submit|keydown|keyup|pointerover|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-24573", "description": "PageLayer <=1.9.4 contributor+ stored XSS via pagelayer_save_content AJAX handler", "mode": "block", "severity": 6.5, "slug": "pagelayer", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2025-24587-01": {"ajax_action": "getEmailTemplate", "conditions": [{"name": "ARGS:entrant", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(.*,.*,|CASE\\\\s+WHEN\\\\s+.*\\\\s+THEN\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24587", "description": "Email Subscription Popup <=1.2.23 authenticated blind SQL injection via entrant parameter in getEmailTemplate AJAX handler", "mode": "block", "severity": 7.6, "slug": "email-subscribe", "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-24601-01": {"action": "init", "conditions": [{"name": "ARGS:dn-listener", "type": "equals", "value": "paypal"}, {"name": "ARGS:custom", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2025-24601", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24601", "description": "FundPress <=2.0.6 unauthenticated PHP object injection via PayPal IPN custom parameter", "mode": "block", "severity": 9.8, "slug": "fundpress", "tags": ["object-injection", "deserialization", "unauthenticated", "paypal-ipn"], "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2025-24648-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:login_redirect_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 privilege escalation via login_redirect_url in profile update", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-02": {"ajax_action": "save_custom_order", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_custom_order AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-03": {"ajax_action": "save_custom_menu_order", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_custom_menu_order AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-04": {"ajax_action": "save_hidden_menu_items", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_hidden_menu_items AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24677-01": {"ajax_action": "pp_wpspin_import_json", "conditions": [{"name": "FILES:pp_wpspin_import_json_file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24677", "description": "Post/Page Import Export <=2.0.3 authenticated remote code execution via arbitrary file write in pp_wpspin_import_json AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "postpage-import-export-with-custom-fields-taxonomies", "tags": ["remote-code-execution", "arbitrary-file-write", "code-injection"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-24677-02": {"ajax_action": "pp_wpspin_export_json", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24677", "description": "Post/Page Import Export <=2.0.3 missing authorization on pp_wpspin_export_json allows authenticated users to export arbitrary posts via IDOR", "method": "POST", "mode": "block", "severity": 9.9, "slug": "postpage-import-export-with-custom-fields-taxonomies", "tags": ["missing-authorization", "information-disclosure", "idor"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-24752-01": {"action": "init", "conditions": [{"name": "ARGS:popup-selector", "type": "regex", "value": "~[<>\\"\'(){}]|javascript\\\\s*:|on(?:error|load|focus|click|mouseover|mouseout|keyup|keydown|submit|change|input|blur)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|style|body|details|marquee|video|audio|form|math|base)~i"}], "cve": "CVE-2025-24752", "method": "GET", "mode": "block", "severity": 6.1, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.14"}, "RULE-CVE-2025-24753-01": {"ajax_action": "kadence_import_get_prebuilt_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-02": {"ajax_action": "kadence_import_reload_prebuilt_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-03": {"ajax_action": "kadence_import_get_new_connection_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-04": {"ajax_action": "kadence_import_get_prebuilt_templates_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-05": {"ajax_action": "kadence_import_reload_prebuilt_templates_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-06": {"ajax_action": "kadence_import_get_prebuilt_pages_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-07": {"ajax_action": "kadence_import_reload_prebuilt_pages_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-08": {"ajax_action": "kadence_import_process_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-09": {"ajax_action": "kadence_import_process_image_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-10": {"ajax_action": "kadence_import_process_pattern", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-11": {"ajax_action": "kadence_subscribe_process_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-2478-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "snippet-edit"}, {"name": "ARGS:snippetId", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-2478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2478", "description": "Code Clone <=1.0.1 time-based blind SQL injection via snippetId on snippet-edit admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "code-clone", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-2478-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "snippet-delete"}, {"name": "ARGS:snippetId", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-2478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2478", "description": "Code Clone <=1.0.1 SQL injection via snippetId on snippet-delete admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "code-clone", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-2481-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mediaview"}, {"name": "ARGS:id", "type": "detectXSS"}], "cve": "CVE-2025-2481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2481", "description": "MediaView <=1.1.2 Reflected Cross-Site Scripting via id parameter on admin pages", "method": "GET", "mode": "block", "severity": 6.1, "slug": "mediaview", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2484-01": {"ajax_action": "mvob_get_video_embed", "conditions": [{"name": "ARGS:video_id", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 unauthenticated reflected XSS via video_id in mvob_get_video_embed AJAX handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-02": {"ajax_action": "mvob_get_video_embed", "conditions": [{"name": "ARGS:group_id", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 unauthenticated reflected XSS via group_id in mvob_get_video_embed AJAX handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-03": {"ajax_action": "mvob_add_videos_to_groups", "conditions": [{"name": "ARGS:add_videos", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 authenticated reflected XSS via add_videos in mvob_add_videos_to_groups AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-04": {"ajax_action": "mvob_remove_videos_from_groups", "conditions": [{"name": "ARGS:remove_videos", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 authenticated reflected XSS via remove_videos in mvob_remove_videos_from_groups AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2513-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "upload-attachment"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:async-upload", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-2537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2537", "description": "NextGEN Gallery <=3.59.11 Stored DOM-Based XSS via image metadata in manage gallery page", "method": "POST", "mode": "block", "severity": 6.4, "slug": "nextgen-gallery", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.59.11"}, "RULE-CVE-2025-2540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[woo3dviewer\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|object|embed|math|video|audio|details|marquee)\\\\b|\\\\bon(?:error|load|click|focus|mouseover|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2540", "description": "Woo 3D Viewer <=1.8.6.6 Stored DOM-Based XSS via [woo3dviewer] shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-3d-viewer", "tags": ["xss", "stored-xss", "shortcode", "prettyphoto"], "target": "plugin", "versions": "<=1.8.6.6"}, "RULE-CVE-2025-2540-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|products?)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[woo3dviewer\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|object|embed|math|video|audio|details|marquee)\\\\b|\\\\bon(?:error|load|click|focus|mouseover|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2540", "description": "Woo 3D Viewer <=1.8.6.6 Stored DOM-Based XSS via [woo3dviewer] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-3d-viewer", "tags": ["xss", "stored-xss", "shortcode", "prettyphoto", "rest-api"], "target": "plugin", "versions": "<=1.8.6.6"}, "RULE-CVE-2025-2543-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/async-upload\\\\.php|/wp-admin/upload\\\\.php)~"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:svg|svgz)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2543", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2543", "description": "Advanced Accordion Block <=5.0.2 stored XSS via malicious SVG file upload through async-upload.php", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-accordion-block", "tags": ["xss", "stored-xss", "svg-upload", "file-upload"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2025-2543-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?|)rest_route=)/wp/v2/media(/|\\\\?|$)~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2543", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2543", "description": "Advanced Accordion Block <=5.0.2 stored XSS via malicious SVG file upload through REST media endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-accordion-block", "tags": ["xss", "stored-xss", "svg-upload", "rest-api"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2025-2563-01": {"ajax_action": "user_registration_user_form_submit", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2025-2563", "method": "POST", "mode": "block", "severity": 8.1, "slug": "user-registration", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-2576-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "upload-attachment"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2576", "description": "Ayyash Studio <=1.0.3 Stored XSS via SVG file upload through WordPress media uploader (admin-ajax.php upload-attachment)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayyash-studio", "tags": ["xss", "stored-xss", "svg-upload", "authenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-2576-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/async-upload\\\\.php(?:\\\\?|$)~"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2576", "description": "Ayyash Studio <=1.0.3 Stored XSS via SVG file upload through WordPress async-upload.php endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayyash-studio", "tags": ["xss", "stored-xss", "svg-upload", "authenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-2579-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/async-upload.php"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:json|lottie)$~i"}], "cve": "CVE-2025-2579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2579", "description": "Lottie Player <=1.1.8 Stored XSS via malicious .json/.lottie file upload through async-upload.php (blocks uploads matching patch behavior of 1.2.0)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-lottie-player", "tags": ["xss", "stored-xss", "file-upload", "authenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-2580-01": {"ajax_action": "bitforms_submit_form", "conditions": [{"name": "ARGS:attachment_name", "type": "regex", "value": "~\\\\.svg(?:$|[\\\\s\\"\'&?#])~i"}], "cve": "CVE-2025-2580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2580", "description": "Bit Form <= 2.18.3 Stored XSS via SVG file upload through bitforms_submit_form AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bit-form", "tags": ["xss", "stored-xss", "svg-upload", "file-upload"], "target": "plugin", "versions": "<=2.18.3"}, "RULE-CVE-2025-2594-01": {"ajax_action": "user_registration_membership_confirm_payment", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"name": "ARGS:auto_login", "type": "regex", "value": "~^(?:true|1|yes|on)$~i"}], "cve": "CVE-2025-2594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2594", "description": "User Registration & Membership <=4.1.2 authentication bypass via membership_confirm_payment AJAX action with auto_login parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "user-registration", "tags": ["authentication-bypass", "idor", "unauthenticated", "account-takeover"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-2635-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "digital-license-manager-activations"}, {"name": "ARGS:license-id", "type": "detectXSS"}], "cve": "CVE-2025-2635", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2635", "description": "Digital License Manager <=1.7.3 reflected XSS via unescaped license-id parameter on Activations admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "digital-license-manager", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-2635-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "digital-license-manager-licenses"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-2635", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2635", "description": "Digital License Manager <=1.7.3 reflected XSS via unescaped search parameter on Licenses admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "digital-license-manager", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-2636-01": {"action": "init", "conditions": [{"name": "ARGS:instawp-database-manager", "type": "exists"}, {"name": "ARGS:instawp-database-manager", "type": "regex", "value": "~(?:\\\\.{2,}[\\\\\\\\/]|%2e%2e(?:%2f|%5c)|php://|data://|expect://|zip://|phar://)~i"}], "cve": "CVE-2025-2636", "mode": "block", "severity": 9.8, "slug": "instawp-connect", "target": "plugin", "versions": "<=0.1.0.85"}, "RULE-CVE-2025-26592-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-26592", "description": "lab theme <= 1.0.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lab", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2025-26592-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-26592", "description": "lab theme <= 1.0.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lab", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2025-26763-04": {"ajax_action": "ms_import_others", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^ms_import_others$~"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}], "cve": "CVE-2025-26763", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-26763", "description": "MetaSlider <=3.94.0 PHP Object Injection via ms_import_others AJAX handler", "mode": "block", "severity": 9.8, "slug": "ml-slider", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.94.0"}, "RULE-CVE-2025-2685-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "tablepress"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:table-name", "type": "detectXSS"}], "cve": "CVE-2025-2685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2685", "description": "TablePress <=3.0.4 Authenticated (Author+) Stored XSS via table-name parameter on admin form POST", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-27007-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/sure-triggers/v1/automation/action(/|\\\\?|&|$)~"}, {"name": "ARGS:type_event", "type": "equals", "value": "create_user_if_not_exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-27007", "method": "POST", "mode": "block", "severity": 9.8, "slug": "suretriggers", "target": "plugin", "versions": "<=1.0.82"}, "RULE-CVE-2025-27012-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "a1post-bg-shipping-for-woocommerce"}, {"name": "ARGS:users_can_register", "type": "exists"}], "cve": "CVE-2025-27012", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-27012", "description": "A1POST.BG Shipping for WooCommerce <=1.5 CSRF to Privilege Escalation via settings page \\u2014 blocks POST with users_can_register option injection", "method": "POST", "mode": "block", "severity": 8.8, "slug": "a1post-bg-shipping-for-woocommerce", "tags": ["csrf", "privilege-escalation", "option-injection"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-27012-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "a1post-bg-shipping-for-woocommerce"}, {"name": "ARGS:default_role", "type": "exists"}], "cve": "CVE-2025-27012", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-27012", "description": "A1POST.BG Shipping for WooCommerce <=1.5 CSRF to Privilege Escalation via settings page \\u2014 blocks POST with default_role option injection", "method": "POST", "mode": "block", "severity": 8.8, "slug": "a1post-bg-shipping-for-woocommerce", "tags": ["csrf", "privilege-escalation", "option-injection"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-2719-01": {"ajax_action": "swatchly_notices", "conditions": [{"name": "ARGS:noticeid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2719", "description": "Swatchly <=1.4.0 missing authorization on swatchly_notices AJAX action allows Subscriber+ to update arbitrary options to true", "method": "POST", "mode": "block", "severity": 6.5, "slug": "swatchly", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-27270-01": {"ajax_action": "suspend_automatic_detection", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-27270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-27270", "description": "Residential Address Detection <=2.5.4 unauthenticated arbitrary option update via suspend_automatic_detection AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "residential-address-detection", "tags": ["missing-authorization", "arbitrary-option-update", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-2779-01": {"ajax_action": "htscript_notices", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2779", "description": "Insert Headers and Footers Code - HT Script <=1.1.2 missing authorization on htscript_notices AJAX action allows arbitrary option update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "insert-headers-and-footers-script", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2779-02": {"ajax_action": "ihafs_diagnostic_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2779", "description": "Insert Headers and Footers Code - HT Script <=1.1.2 missing authorization on ihafs_diagnostic_data AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "insert-headers-and-footers-script", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2800-01": {"ajax_action": "add_organizer", "conditions": [{"name": "ARGS:organizer_name", "type": "detectXSS"}], "cve": "CVE-2025-2800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2800", "description": "WP Event Manager <=3.1.50 unauthenticated stored XSS via organizer_name in add_organizer AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-event-manager", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.50"}, "RULE-CVE-2025-2801-01": {"ajax_action": "abcsubmit_form_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[.+\\\\]~s"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2801", "description": "ABCSubmit <=1.2.3 unauthenticated arbitrary shortcode execution via abcsubmit_form_preview AJAX handler", "method": "POST", "mode": "block", "severity": 7.3, "slug": "abcsubmit", "tags": ["code-injection", "arbitrary-shortcode", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-2805-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~[[][a-z][a-z0-9_-]{2,} [^]]*=[^]]*[]]~"}], "cve": "CVE-2025-2805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2805", "description": "ORDER POST <=2.0.2 unauthenticated arbitrary shortcode execution via comment text containing shortcode syntax", "method": "POST", "mode": "block", "severity": 7.3, "slug": "order-post", "tags": ["code-injection", "shortcode-injection", "unauthenticated", "stored-attack"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-2807-01": {"ajax_action": "mvl_setup_wizard_install_plugin", "conditions": [{"name": "ARGS:plugin", "type": "regex", "value": "~.+~"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-2807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2807", "description": "Motors - Car Dealership & Classified Listings <= 1.4.64 missing authorization on mvl_setup_wizard_install_plugin allowing Subscriber+ arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "motors-car-dealership-classified-listings", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=1.4.64"}, "RULE-CVE-2025-2816-01": {"ajax_action": "pvc_yellow_message_dontshow", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2816", "description": "Page View Count <=2.8.4 missing authorization on pvc_yellow_message_dontshow AJAX handler allows arbitrary option update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "page-views-count", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=2.8.4"}, "RULE-CVE-2025-2821-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/search-exclude/v1/settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2821", "description": "Search Exclude <=2.4.9 missing authorization on REST API settings modification endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "search-exclude", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2025-2821-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/search-exclude/v1/settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2821", "description": "Search Exclude <=2.4.9 missing authorization on REST API settings read endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "search-exclude", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2025-2839-01": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-02": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data \\u2014 event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-03": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:svg|iframe|embed|object)\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data \\u2014 dangerous tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-04": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 script tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-05": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-06": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:svg|iframe|embed|object)\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 dangerous tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2889-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_type", "type": "equals", "value": "link_library_links"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*(?:on[a-zA-Z0-9_]+ *=|xmlns|style *=[ ]*[\\"\'][^\\"\']*(?:expression|url) *\\\\()|< *(?:script|iframe|object|embed|form|svg|math|base|link|meta)|javascript *:|data *: *text/html~i"}], "cve": "CVE-2025-2889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2889", "description": "Link Library <=7.7.3 Authenticated (Contributor+) Stored XSS via Link Additional Parameters on post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "link-library", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.7.3"}, "RULE-CVE-2025-2893-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-2893-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-2893-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in classic editor post submission", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-28983-01": {"ajax_action": "CNPCF_cnpgroupname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpgroupname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-02": {"ajax_action": "CNPCF_friendlyname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_friendlyname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-03": {"ajax_action": "CNPCF_cnpaccountid", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpaccountid AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-04": {"ajax_action": "CNPCF_cnpchnlgroupname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpchnlgroupname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-05": {"ajax_action": "getCnPUserChannelList", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on getCnPUserChannelList AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-2940-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-post.php"}, {"name": "ARGS:action", "type": "contains", "value": "wpf-async-request-"}, {"name": "ARGS:args[url]", "type": "exists"}], "cve": "CVE-2025-2940", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2940", "description": "Ninja Tables <= 5.0.18 unauthenticated SSRF via WPFluent async request handler args[url] parameter", "mode": "block", "severity": 7.2, "slug": "ninja-tables", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": "<=5.0.18"}, "RULE-CVE-2025-2941-01": {"ajax_action": "dnd_codedropz_upload_wc", "conditions": [{"name": "FILES:wc-upload-file[]", "type": "exists"}], "cve": "CVE-2025-2941", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-2941-02": {"ajax_action": "dnd_codedropz_upload_delete_wc", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]\\\\.\\\\.)|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|(?:^|[\\\\\\\\/])\\\\.env(?:$|[\\\\\\\\/]))~i"}], "cve": "CVE-2025-2941", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-3058-01": {"ajax_action": "xwc_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:settings", "type": "exists"}], "cve": "CVE-2025-3058", "method": "POST", "mode": "block", "severity": 8.8, "slug": "xelion-webchat", "target": "plugin", "versions": "<=9.1.0"}, "RULE-CVE-2025-3064-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:option_page", "type": "equals", "value": "general"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:default_role", "type": "regex", "value": "~(?i)^administrator$~"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via default_role=administrator on options.php", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "state-change"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3064-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/network/settings.php"}, {"name": "ARGS:default_role", "type": "regex", "value": "~(?i)^administrator$~"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via default_role=administrator on network settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "multisite"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3064-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:option_page", "type": "equals", "value": "general"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:wpfront-secondary-roles[administrator]", "type": "exists"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via secondary roles including administrator", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "state-change"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3075-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\\\bon(?:mouse(?:over|enter|move|out|down|up)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|animate(?:end|start|iteration)|transition(?:end|run|start)|pointer(?:over|enter|down|up|move|out)|touch(?:start|end|move))\\\\s*=~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-3075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3075", "description": "Elementor <=3.29.0 Authenticated (Contributor+) Stored XSS via widget settings in elementor_ajax save handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementor", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=3.29.0"}, "RULE-CVE-2025-30772-01": {"ajax_action": "wpcuf_import_export_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-30772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30772", "description": "WPC Smart Upsell Funnel <=3.0.4 arbitrary option update to privilege escalation via wpcuf_import_export_save AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-smart-upsell-funnel", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-option-update"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-30772-02": {"ajax_action": "wpcuf_import_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-30772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30772", "description": "WPC Smart Upsell Funnel <=3.0.4 missing authorization on wpcuf_import_export AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-smart-upsell-funnel", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-option-update"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-30773-01": {"ajax_action": "trp_save_translations_regular", "conditions": [{"name": "ARGS:strings", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_save_translations_regular strings parameter", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30773-02": {"ajax_action": "trp_save_translations_gettext", "conditions": [{"name": "ARGS:strings", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_save_translations_gettext strings parameter", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30773-03": {"ajax_action": "trp_update_database", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_update_database AJAX handler", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30911-01": {"ajax_action": "install_requirements", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-30911", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30911", "description": "RomethemeKit For Elementor <=1.5.4 missing authorization on install_requirements allows subscriber+ arbitrary plugin installation leading to RCE", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["missing-authorization", "arbitrary-plugin-install", "remote-code-execution"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-30911-02": {"ajax_action": "import_rtm_template", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-30911", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30911", "description": "RomethemeKit For Elementor <=1.5.4 missing authorization on import_rtm_template allows subscriber+ arbitrary file write leading to RCE", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["missing-authorization", "arbitrary-file-write", "remote-code-execution"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-31019-01": {"action": "init", "conditions": [{"name": "ARGS:mopppm_userid", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-31019", "method": "POST", "mode": "block", "severity": 8.8, "slug": "password-policy-manager", "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-3102-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/(?:sure-triggers|suretriggers|ottokit)/v1/(?:authenticate-user|automation/action)(?:/|\\\\?|$)~i"}, {"name": "REQUEST_HEADERS:st_authorization", "type": "regex", "value": "~^(?:[\\\\s]*|Bearer[\\\\s]*)$~i"}], "cve": "CVE-2025-3102", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3102", "description": "SureTriggers <=1.0.78 unauthenticated REST API authentication bypass via empty st_authorization header", "method": "POST", "mode": "block", "severity": 9.8, "slug": "suretriggers", "tags": ["authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.0.78"}, "RULE-CVE-2025-3106-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:[?#]|$)~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"action\\"\\\\s*:\\\\s*\\"save_builder\\"~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"widgetType\\"\\\\s*:\\\\s*\\"lakit-table-of-contents\\"~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:\\"icon\\"\\\\s*:\\\\s*\\\\{[^{}\\\\r\\\\n]{0,1024}\\"value\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\\\\\r\\\\n]{0,256}(?:\\\\\\\\\\"|\\\\\\\\u0022)[^\\"\\\\r\\\\n]{0,128}\\\\bon[a-z][a-z0-9_:-]*\\\\s*=|&(?:lt|\\\\#0*60|\\\\#x0*3c);\\\\s*(?:script(?=\\\\s|&(?:gt|\\\\#0*62|\\\\#x0*3e);)|(?:img|svg|iframe|object|embed|details|math|video|audio|body)\\\\b[^\\\\r\\\\n]{0,512}?\\\\bon[a-z][a-z0-9_:-]*\\\\s*=))~ix"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3106", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3106", "description": "LA-Studio Element Kit for Elementor <=1.4.9 authenticated stored XSS via unsanitized Table of Contents list text or icon value in Elementor save_builder", "method": "POST", "mode": "block", "severity": 6.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.4.9"}, "RULE-CVE-2025-3107-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in post_content (classic editor POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (PUT)", "method": "PUT", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-31081-01": {"action": "attachment_submitbox_misc_actions", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-31081", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-31081", "description": "Enable Media Replace <=4.1.5 reflected XSS via unescaped get_post_meta output in admin_date_replaced_media_on_edit_media_screen (classes/emr-plugin.php:614-620); exact reflected request parameter and write-site are unresolved in current artefacts, capability-scoped minimal rule pending further evidence", "mode": "block", "severity": 7.1, "slug": "enable-media-replace", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=4.1.5"}, "RULE-CVE-2025-31560-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "salon-customers"}, {"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-31560-02A": {"ajax_action": "salon", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-31560-02B": {"ajax_action": "salon", "conditions": [{"name": "ARGS:user_role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-32118-01": {"ajax_action": "cmp_ajax_upload_font", "conditions": [{"name": "FILES:font_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2025-32118", "description": "CMP Coming Soon & Maintenance <=4.1.14 authenticated arbitrary file upload via cmp_ajax_upload_font", "mode": "block", "severity": 9.1, "slug": "cmp-coming-soon-maintenance", "target": "plugin", "versions": "<=4.1.14"}, "RULE-CVE-2025-32143-01": {"ajax_action": "accordions_ajax_import_json", "conditions": [{"name": "ARGS:accordions_data", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-32143", "description": "Accordion <=2.3.11 PHP object injection via accordions_data parameter in import handler", "mode": "block", "severity": 8.8, "slug": "accordions", "target": "plugin", "versions": "<=2.3.11"}, "RULE-CVE-2025-32486-01": {"ajax_action": "public_amd_ajax_handler", "conditions": [{"name": "ARGS:reset_password[new_password]", "type": "exists"}, {"name": "ARGS:reset_password[vcode]", "type": "regex", "value": "~^0[eE]\\\\d+$~"}], "cve": "CVE-2025-32486", "method": "POST", "mode": "block", "severity": 9.8, "slug": "material-dashboard", "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2025-32568-01": {"ajax_action": "empik_csv_process_emp_log_classes", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-32568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32568", "description": "EmpikPlace for WooCommerce <=1.4.3 PHP Object Injection via empik_csv_process_emp_log_classes AJAX handler", "mode": "block", "severity": 9.8, "slug": "empik-for-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-32568-02": {"ajax_action": "empik_csv_process_emp_prod_states", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-32568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32568", "description": "EmpikPlace for WooCommerce <=1.4.3 PHP Object Injection via empik_csv_process_emp_prod_states AJAX handler", "mode": "block", "severity": 9.8, "slug": "empik-for-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-32597-01": {"ajax_action": "cdaily", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^A-Za-z0-9_.$]~"}], "cve": "CVE-2025-32597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32597", "description": "Connect Daily Web Calendar <=1.5.4 reflected XSS via unsanitized JSONP callback parameter in cdaily AJAX handler", "mode": "block", "severity": 7.1, "slug": "connect-daily-web-calendar", "tags": ["xss", "csrf", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-32648-01": {"ajax_action": "pto_ajax_register", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author|contributor|admin)$~i"}], "cve": "CVE-2025-32648", "method": "POST", "mode": "block", "severity": 9.8, "slug": "projectopia-core", "target": "plugin", "versions": "<=5.1.23"}, "RULE-CVE-2025-32652-01": {"ajax_action": "solace_extra_upload_logo", "conditions": [{"name": "ARGS:logo_url", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:[?#%/]|$)|\\\\.htaccess(?:[?#%/]|$)|\\\\.htpasswd(?:[?#%/]|$)~i"}], "cve": "CVE-2025-32652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32652", "description": "Solace Extra <=1.3.1 arbitrary file upload via solace_extra_upload_logo AJAX handler allowing remote PHP file write", "mode": "block", "severity": 9.9, "slug": "solace-extra", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-32682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mapsvg/v[0-9]+/~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-32682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32682", "description": "MapSVG Lite <=8.6.4 authenticated (Contributor+) arbitrary file upload via REST API allowing web shell deployment", "method": "POST", "mode": "block", "severity": 9.9, "slug": "mapsvg-lite-interactive-vector-maps", "tags": ["arbitrary-file-upload", "remote-code-execution", "rest-api", "authenticated"], "target": "plugin", "versions": "<=8.6.4"}, "RULE-CVE-2025-3281-01": {"ajax_action": "user_registration_membership_create_stripe_subscription", "conditions": [{"name": "ARGS:member_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 IDOR in create_stripe_subscription allowing unauthenticated user deletion via member_id", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["idor", "missing-authorization", "unauthenticated", "user-deletion"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3281-03": {"ajax_action": "user_registration_membership_verify_pages", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 missing authorization on verify_pages membership AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3281-04": {"ajax_action": "user_registration_membership_validate_pg", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 missing authorization on validate_pg membership AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3418-01": {"ajax_action": "wpcac_edit_save", "conditions": [{"name": "ARGS:field", "type": "regex", "value": "~^(wp_capabilities|wp_user_level|role)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3418", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-admin-columns", "target": "plugin", "versions": ">=2.0.6 <=2.1.0"}, "RULE-CVE-2025-3421-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "evf-entries"}, {"name": "ARGS:form_id", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]*(?:on[a-z]+=|src\\\\s*=\\\\s*[\'\\"]?javascript))~i"}], "cve": "CVE-2025-3421", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3421", "description": "Everest Forms <=3.1.1 Reflected Cross-Site Scripting via form_id parameter on admin entries page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "everest-forms", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-3422-01": {"ajax_action": "everest_forms_form_preview_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3422", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3422", "description": "Everest Forms <=3.1.1 authenticated arbitrary shortcode execution via form_preview_save AJAX action", "method": "POST", "mode": "block", "severity": 6.3, "slug": "everest-forms", "tags": ["missing-authorization", "arbitrary-shortcode-execution", "code-injection"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-3428-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "3dprintlite_coatings"}, {"name": "ARGS:coating_text", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-3428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3428", "description": "3DPrint Lite <=2.1.3.6 authenticated (Admin+) SQL injection via coating_text parameter on coatings admin page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "3dprint-lite", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.1.3.6"}, "RULE-CVE-2025-3428-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "3dprintlite_coatings"}, {"name": "ARGS:coating_text", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-3428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3428", "description": "3DPrint Lite <=2.1.3.6 authenticated (Admin+) SQL injection via coating_text parameter on coatings admin page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "3dprint-lite", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.1.3.6"}, "RULE-CVE-2025-3434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:<|�*60;|�*3c;)\\\\s*script\\\\b|\\\\bon[a-zA-Z0-9_]+\\\\s*=|]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3435", "description": "Mang Board WP <=1.8.6 Stored XSS via board_header parameter in mb_board AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "mangboard", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.8.6"}, "RULE-CVE-2025-3435-02": {"ajax_action": "mb_board", "conditions": [{"name": "ARGS:board_footer", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3435", "description": "Mang Board WP <=1.8.6 Stored XSS via board_footer parameter in mb_board AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "mangboard", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.8.6"}, "RULE-CVE-2025-3436-01": {"ajax_action": "coreactivity_live_logs", "conditions": [{"name": "ARGS:orderby", "type": "detectSQLi"}], "cve": "CVE-2025-3436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3436", "description": "coreActivity <=2.7 SQL injection via orderby parameter in Live Logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "coreactivity", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.7"}, "RULE-CVE-2025-3436-02": {"ajax_action": "coreactivity_live_logs", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-3436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3436", "description": "coreActivity <=2.7 SQL injection via order parameter in Live Logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "coreactivity", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.7"}, "RULE-CVE-2025-3438-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/(?:register|sign_up|sign_up_2)(/|\\\\?|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!(subscriber|customer|owner|driver)$).+$~"}], "cve": "CVE-2025-3438", "method": "POST", "mode": "block", "severity": 7.3, "slug": "mstore-api", "target": "plugin", "versions": "<4.17.5"}, "RULE-CVE-2025-3439-01": {"action": "init", "conditions": [{"name": "ARGS:everest_forms[id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-3439", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "target": "plugin", "versions": "<3.1.2"}, "RULE-CVE-2025-3439-02": {"ajax_action": "everest_forms_ajax_form_submission", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-3439", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "target": "plugin", "versions": "<3.1.2"}, "RULE-CVE-2025-3455-01": {"action": "admin_post_start_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated arbitrary file upload via start_restore admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["arbitrary-file-upload", "missing-authorization", "file-upload"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3455-02": {"action": "admin_post_start_backup", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated missing authorization on start_backup admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3455-03": {"action": "admin_post_cancel_actions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated missing authorization on cancel_actions admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3457-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[oceanwp_icon"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[oceanwp_icon\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3457", "description": "Ocean Extra <=2.4.6 Stored XSS via [oceanwp_icon] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3457-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[oceanwp_icon"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[oceanwp_icon\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3457", "description": "Ocean Extra <=2.4.6 Stored XSS via [oceanwp_icon] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3458-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:ocean_gallery_id[/[0-9]+/]", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-3458", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3458", "description": "Ocean Extra <=2.4.6 stored XSS via unsanitized ocean_gallery_id in gallery metabox", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3468-01": {"ajax_action": "nf_insert_record", "conditions": [{"name": "ARGS:clean_html", "type": "regex", "value": "~]*>|javascript\\\\s*:|]+src\\\\s*=\\\\s*[\\"\']?javascript:|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via clean_html parameter in nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-02": {"ajax_action": "nf_insert_record", "conditions": [{"name": "ARGS:form_fields", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|]+src\\\\s*=\\\\s*[\\"\']?javascript:|]*\\\\bon~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via form_fields parameter in nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-03": {"ajax_action": "nf_update_record", "conditions": [{"name": "ARGS:clean_html", "type": "regex", "value": "~]*>|javascript\\\\s*:|]+src\\\\s*=\\\\s*[\\"\']?javascript:|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via clean_html parameter in nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-04": {"ajax_action": "nf_update_record", "conditions": [{"name": "ARGS:form_fields", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|]+src\\\\s*=\\\\s*[\\"\']?javascript:|]*\\\\bon~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via form_fields parameter in nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3471-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/sureforms/v1/global-settings(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3471", "description": "SureForms <1.4.4 incorrect authorization on global-settings REST API endpoint allows Contributor+ to update plugin settings", "method": "POST", "mode": "block", "severity": 4.9, "slug": "sureforms", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<1.4.4"}, "RULE-CVE-2025-3487-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[forminator_form[^\\\\]]*\\\\blimit\\\\s*=\\\\s*([\\"\'])[\\\\s\\\\S]*?(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}\\\\s*=|javascript\\\\s*:|&#\\\\d+;|&#x[0-9a-fA-F]+;)[\\\\s\\\\S]*?\\\\1~i"}], "cve": "CVE-2025-3487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3487", "description": "Forminator <=1.42.0 Stored XSS via limit parameter in forminator_list_pagination", "mode": "block", "severity": 5.4, "slug": "forminator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.42.0"}, "RULE-CVE-2025-3515-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "dnd_codedropz_upload"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:phar|pht|phtml|php[0-9]?|phps|php\\\\.[^./]+|inc)$~i"}], "cve": "CVE-2025-3515", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "target": "plugin", "versions": "<=1.3.8.9"}, "RULE-CVE-2025-3516-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[\\"\']\\\\s*on(error|load|mouseover|click|focus|blur|mouseenter|submit|animationend|transitionend|pointerover|focusin)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3516", "description": "Simple Lightbox <=2.9.3 Contributor+ Stored XSS via post_content attribute injection (classic editor)", "method": "POST", "mode": "block", "severity": 5.9, "slug": "simple-lightbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-3516-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']\\\\s*on(error|load|mouseover|click|focus|blur|mouseenter|submit|animationend|transitionend|pointerover|focusin)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3516", "description": "Simple Lightbox <=2.9.3 Contributor+ Stored XSS via REST API post content attribute injection", "method": "POST", "mode": "block", "severity": 5.9, "slug": "simple-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-3520-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~"}, {"name": "ARGS:delete-avatar", "type": "exists"}, {"name": "ARGS:image_src", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2025-3520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3520", "description": "Avatar <=0.1.4 authenticated arbitrary file deletion via path traversal on profile.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "avatar", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=0.1.4"}, "RULE-CVE-2025-3520-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/user-edit\\\\.php~"}, {"name": "ARGS:delete-avatar", "type": "exists"}, {"name": "ARGS:image_src", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2025-3520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3520", "description": "Avatar <=0.1.4 authenticated arbitrary file deletion via path traversal on user-edit.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "avatar", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=0.1.4"}, "RULE-CVE-2025-3597-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~fancybox[^}]*\\\\{[^}]*(?:function|eval|alert|document|window|fetch|XMLHttpRequest|setTimeout|setInterval|constructor|\\\\bon[A-Z])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3597", "description": "Easy FancyBox <=2.3.14 Stored XSS via jQuery Metadata in post_content on classic editor", "method": "POST", "mode": "block", "severity": 5.9, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "post-content"], "target": "plugin", "versions": "<=2.3.14"}, "RULE-CVE-2025-3597-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~fancybox[^}]*\\\\{[^}]*(?:function|eval|alert|document|window|fetch|XMLHttpRequest|setTimeout|setInterval|constructor|\\\\bon[A-Z])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3597", "description": "Easy FancyBox <=2.3.14 Stored XSS via jQuery Metadata in content on REST API posts endpoint", "method": "POST", "mode": "block", "severity": 5.9, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=2.3.14"}, "RULE-CVE-2025-3614-01": {"ajax_action": "ekit_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript[ ]*:|&#[xX]?[0-9a-fA-F]+;?[a-zA-Z]*script[ ]*:|data[ ]*:[ ]*text/html|on(?:mouse(?:over|enter|move|out|down|up)|error|load|click|focus|blur|change|submit|key(?:down|up|press)|dblclick|drag|drop|resize|scroll|unload|beforeunload|pointerover|pointerenter|animationend|transitionend)[ ]*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3614", "description": "ElementsKit Elementor Addons <=3.5.2 Stored XSS via Widget Builder URL control through ekit_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "widget-builder"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-3616-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v1/proxy-api(/|\\\\?|$)~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-3616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3616", "description": "GreenShift Animation and Page Builder Blocks >=11.4 <=11.4.5 authenticated arbitrary file upload via REST proxy-api endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["arbitrary-file-upload", "missing-authorization", "rest-api", "file-upload"], "target": "plugin", "versions": ">=11.4 <=11.4.5"}, "RULE-CVE-2025-3649-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:�*58;?|�*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (post editor)", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3649-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:�*58;?|�*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (REST API POST)", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3649-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:�*58;?|�*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (REST API PUT)", "method": "PUT", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3662-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~]+(?:title|data-caption)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|<)(?:img|svg|iframe|script|body|video|audio|details|marquee|object|embed|math|input|select|textarea|button|form|keygen|isindex)\\\\b[^\\"\']*(?:onerror|onload|onmouseover|onfocus|onblur|onclick|onmouseenter|onanimationend|ontoggle|onpointerover|oncontextmenu)\\\\s*=~i"}], "cve": "CVE-2025-3662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3662", "description": "FancyBox for WordPress <3.3.6 unauthenticated stored XSS via comment submission with malicious anchor title/data-caption attributes", "method": "POST", "mode": "block", "severity": 6.1, "slug": "fancybox-for-wordpress", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<3.3.6"}, "RULE-CVE-2025-3662-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~]+(?:title|data-caption)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|<)(?:img|svg|iframe|script|body|video|audio|details|marquee|object|embed|math|input|select|textarea|button|form|keygen|isindex)\\\\b[^\\"\']*(?:onerror|onload|onmouseover|onfocus|onblur|onclick|onmouseenter|onanimationend|ontoggle|onpointerover|oncontextmenu)\\\\s*=~i"}], "cve": "CVE-2025-3662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3662", "description": "FancyBox for WordPress <3.3.6 Contributor+ stored XSS via post content with malicious anchor title/data-caption attributes", "method": "POST", "mode": "block", "severity": 6.1, "slug": "fancybox-for-wordpress", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<3.3.6"}, "RULE-CVE-2025-3703-01": {"ajax_action": "cjtoolbox_get_info_view", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) local file inclusion via cjtoolbox_get_info_view AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-02": {"ajax_action": "cjtoolbox_create", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_create AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-03": {"ajax_action": "cjtoolbox_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_delete AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-04": {"ajax_action": "cjtoolbox_set_property", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_set_property AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-05": {"ajax_action": "cjtoolbox_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_restore AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-06": {"ajax_action": "cjtoolbox_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_list AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-07": {"ajax_action": "cjtoolbox_get_revision", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_get_revision AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-08": {"ajax_action": "cjtoolbox_get_revisions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_get_revisions AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3752-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ableplayer\\\\b[^\\\\]]*\\\\bpreload\\\\s*=\\\\s*(?:\\"(?!auto\\"|metadata\\"|none\\")[^\\"]+\\"|\'(?!auto\'|metadata\'|none\')[^\']+\'|(?!auto\\\\b|metadata\\\\b|none\\\\b)\\\\S+)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3752", "description": "Able Player <=1.2.1 Stored XSS via [ableplayer] shortcode preload attribute (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ableplayer", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-3752-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ableplayer\\\\b[^\\\\]]*\\\\bpreload\\\\s*=\\\\s*(?:\\"(?!auto\\"|metadata\\"|none\\")[^\\"]+\\"|\'(?!auto\'|metadata\'|none\')[^\']+\'|(?!auto\\\\b|metadata\\\\b|none\\\\b)\\\\S+)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3752", "description": "Able Player <=1.2.1 Stored XSS via [ableplayer] shortcode preload attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ableplayer", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-3761-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(profile|user-edit)\\\\.php~"}, {"name": "ARGS:mt_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3761", "description": "My Tickets <= 2.0.16 authenticated privilege escalation via mt_capabilities in profile update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "my-tickets", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.16"}, "RULE-CVE-2025-3775-01": {"ajax_action": "woolentor_proxy_image", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://(?!library\\\\.shoplentor\\\\.com(:[0-9]+)?(/|$|\\\\?))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3775", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3775", "description": "ShopLentor (WooLentor) <=3.1.2 unauthenticated SSRF via woolentor_proxy_image AJAX endpoint \\u2014 blocks requests where the url parameter targets any host other than the legitimate library.shoplentor.com", "mode": "block", "severity": 6.5, "slug": "woolentor-addons", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-3779-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ply-widget\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3779", "description": "Personizely <=0.10 Stored XSS via [ply-widget] shortcode attribute in post_content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "personizely", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.10"}, "RULE-CVE-2025-3779-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ply-placeholder\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3779", "description": "Personizely <=0.10 Stored XSS via [ply-placeholder] shortcode attribute in post_content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "personizely", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.10"}, "RULE-CVE-2025-3779-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ply-widget\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3779", "description": "Personizely <=0.10 Stored XSS via [ply-widget] shortcode attribute in REST API post content", "mode": "block", "severity": 6.4, "slug": "personizely", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.10"}, "RULE-CVE-2025-3779-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ply-placeholder\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3779", "description": "Personizely <=0.10 Stored XSS via [ply-placeholder] shortcode attribute in REST API post content", "mode": "block", "severity": 6.4, "slug": "personizely", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.10"}, "RULE-CVE-2025-3780-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wcfm-setup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3780", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3780", "description": "WCFM Frontend Manager <=6.7.16 unauthenticated plugin settings modification via admin_init setup redirect", "mode": "block", "severity": 6.5, "slug": "wc-frontend-manager", "tags": ["missing-authorization", "unauthenticated", "settings-tampering"], "target": "plugin", "versions": "<=6.7.16"}, "RULE-CVE-2025-3781-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[raisely_donation_form\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-3781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3781", "description": "Raisely Donation Form <=1.1 Stored XSS via raisely_donation_form shortcode attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "raisely-donation-form", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-3781-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[raisely_donation_form\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-3781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3781", "description": "Raisely Donation Form <=1.1 Stored XSS via raisely_donation_form shortcode attributes in REST API post content", "mode": "block", "severity": 6.4, "slug": "raisely-donation-form", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-3782-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cision-block\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*(?:(?:on\\\\w+)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed)|javascript\\\\s*:)~is"}], "cve": "CVE-2025-3782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3782", "description": "Cision Block <=4.3.0 Stored XSS via shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cision-block", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.3.0"}, "RULE-CVE-2025-3782-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[cision-block\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*(?:(?:on\\\\w+)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed)|javascript\\\\s*:)~is"}], "cve": "CVE-2025-3782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3782", "description": "Cision Block <=4.3.0 Stored XSS via shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cision-block", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.3.0"}, "RULE-CVE-2025-3809-01": {"ajax_action": "log_js_errors", "conditions": [{"name": "ARGS:error", "type": "regex", "value": "~(?i)(<\\\\s*script\\\\b|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3809", "description": "Debug Log Manager <=2.3.4 unauthenticated stored XSS via log_js_errors AJAX error parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "debug-log-manager", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2025-3810-01": {"ajax_action": "wpb_ajax_post", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "edit_profile_data"}, {"name": "ARGS:pass1", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-3810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3810", "description": "WPBookit <1.0.3 unauthenticated account takeover via IDOR in edit_profile_data", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpbookit", "tags": ["idor", "account-takeover", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<1.0.3"}, "RULE-CVE-2025-3858-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[formality[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<\\\\s*(?:script|svg|img|iframe|embed|object|form|details)|on[a-z]+=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3858", "description": "Formality <=1.5.8 Stored XSS via [formality] shortcode align attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "formality", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.5.8"}, "RULE-CVE-2025-3858-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[formality[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<\\\\s*(?:script|svg|img|iframe|embed|object|form|details)|on[a-z]+=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3858", "description": "Formality <=1.5.8 Stored XSS via [formality] shortcode align attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "formality", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.5.8"}, "RULE-CVE-2025-3860-01": {"ajax_action": "sc_ajax_handler", "conditions": [{"name": "ARGS:saleclass", "type": "exists"}, {"name": "ARGS:saleclass", "type": "regex", "value": "~[<>\\"\']~"}], "cve": "CVE-2025-3860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3860", "description": "CarDealerPress <=6.8.2505.00 Stored XSS via saleclass parameter in sc_ajax_handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cardealerpress", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.8.2505.00"}, "RULE-CVE-2025-3861-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API protect files endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/un-protect-files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API un-protect files endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API file protection status endpoint", "method": "GET", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/private-urls/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API private URLs endpoint", "method": "GET", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3862-01": {"action": "init", "conditions": [{"name": "ARGS:cg_off_id", "type": "regex", "value": "~[<>\\"\'();]~"}], "cve": "CVE-2025-3862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3862", "description": "Contest Gallery <= 26.0.6 Stored XSS via cg_off_id parameter in shortcode rendering", "mode": "block", "severity": 5.4, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=26.0.6"}, "RULE-CVE-2025-3868-01": {"action": "admin_init", "conditions": [{"name": "ARGS:menuObject", "type": "detectXSS"}], "cve": "CVE-2025-3868", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3868", "description": "Custom Admin-Bar Favorites <=0.1 reflected XSS via menuObject parameter", "mode": "block", "severity": 6.1, "slug": "admin-bookmarks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-3876-01": {"action": "init", "conditions": [{"name": "ARGS:option", "type": "equals", "value": "smsalert_ajax_form_validate"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3876", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sms-alert", "target": "plugin", "versions": "<=3.8.1"}, "RULE-CVE-2025-3878-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[sa_verify\\\\s[^\\\\]]*(?:phone_selector|submit_selector|user_selector|pwd_selector|placeholder)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\'\\"]\\\\s*\\\\)|]*\\\\bon[a-z]{3,}\\\\s*=|\\\\bstyle\\\\s*=|\\\\bautofocus|\\\\bjavascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via ftp_user parameter (wp_unslash only, no sanitize_text_field)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3919-02": {"action": "admin_init", "conditions": [{"name": "ARGS:ftp_password", "type": "regex", "value": "~(?:<[a-z]|\\\\x3c[a-z]|\\"|%22|&#(?:x22|34);?)(?:[^>]*\\\\bon[a-z]{3,}\\\\s*=|\\\\bstyle\\\\s*=|\\\\bautofocus|\\\\bjavascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via ftp_password parameter (wp_unslash only, no sanitize_text_field)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3919-03": {"action": "admin_init", "conditions": [{"name": "ARGS:ftp_server", "type": "regex", "value": "~(?:\\"|%22|&#(?:x22|34);?)\\\\s*(?:on[a-z]{3,}\\\\s*=|style\\\\s*=|autofocus|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via ftp_server attribute breakout (sanitize_text_field strips tags but not quotes)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3919-04": {"action": "admin_init", "conditions": [{"name": "ARGS:ftp_server_path", "type": "regex", "value": "~(?:\\"|%22|&#(?:x22|34);?)\\\\s*(?:on[a-z]{3,}\\\\s*=|style\\\\s*=|autofocus|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via ftp_server_path attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3919-05": {"action": "admin_init", "conditions": [{"name": "ARGS:export_ftp_path", "type": "regex", "value": "~(?:\\"|%22|&#(?:x22|34);?)\\\\s*(?:on[a-z]{3,}\\\\s*=|style\\\\s*=|autofocus|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via export_ftp_path attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3919-06": {"action": "admin_init", "conditions": [{"name": "ARGS:export_ftp_file_name", "type": "regex", "value": "~(?:\\"|%22|&#(?:x22|34);?)\\\\s*(?:on[a-z]{3,}\\\\s*=|style\\\\s*=|autofocus|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via export_ftp_file_name attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3921-01": {"ajax_action": "pepro_reglogin", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS", "type": "regex", "value": "~(?:wp_capabilities|wp_user_level)~i"}], "cve": "CVE-2025-3921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3921", "description": "PeproDev Ultimate Profile Solutions <=7.5.2 unauthenticated arbitrary user meta update via pepro_reglogin AJAX handler", "method": "POST", "mode": "block", "severity": 8.2, "slug": "peprodev-ups", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=7.5.2"}, "RULE-CVE-2025-39458-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-39458", "description": "foton theme <= 2.5.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "foton", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.5.2"}, "RULE-CVE-2025-39458-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-39458", "description": "foton theme <= 2.5.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "foton", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.5.2"}, "RULE-CVE-2025-39466-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-39466", "description": "dor theme <= 2.4 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dor", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2025-39466-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-39466", "description": "dor theme <= 2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dor", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2025-39490-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-39490", "description": "backpacktraveler theme <= 2.10.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "backpacktraveler", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.10.2"}, "RULE-CVE-2025-39490-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-39490", "description": "backpacktraveler theme <= 2.10.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "backpacktraveler", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.10.2"}, "RULE-CVE-2025-3952-01": {"ajax_action": "pto_remove_logo", "conditions": [{"name": "ARGS:type", "type": "exists"}, {"type": "missing_capability", "value": "edit_cqpim_settings"}], "cve": "CVE-2025-3952", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3952", "description": "Projectopia <=5.1.16 missing authorization on pto_remove_logo AJAX handler allows authenticated users (Subscriber+) to clear arbitrary WordPress options via the type parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "projectopia-core", "tags": ["missing-authorization", "broken-access-control", "arbitrary-option-update"], "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2025-3953-01": {"ajax_action": "wp_statistics_option_updater", "conditions": [{"name": "ARGS:option", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3953", "description": "WP Statistics <=14.13.3 missing authorization on wp_statistics_option_updater AJAX handler allows authenticated users to update arbitrary plugin settings", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=14.13.3"}, "RULE-CVE-2025-39550-01": {"ajax_action": "fcom_user_registration", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2025-39550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39550", "description": "FluentCommunity <=1.2.15 unauthenticated PHP object injection via fcom_user_registration AJAX handler", "mode": "block", "severity": 9.8, "slug": "fluent-community", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.2.15"}, "RULE-CVE-2025-39550-02": {"ajax_action": "fcom_user_login_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2025-39550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39550", "description": "FluentCommunity <=1.2.15 unauthenticated PHP object injection via fcom_user_login_form AJAX handler", "mode": "block", "severity": 9.8, "slug": "fluent-community", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.2.15"}, "RULE-CVE-2025-39551-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluent-boards/~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2025-39551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39551", "description": "FluentBoards <=1.47 unauthenticated PHP object injection via REST API deserialization", "mode": "block", "severity": 9.8, "slug": "fluent-boards", "tags": ["object-injection", "deserialization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-39557-01": {"action": "admin_init", "conditions": [{"name": "ARGS:kadence-woomail-import", "type": "exists"}, {"name": "FILES:kadence-woomail-import-file:name", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml?|phar|shtml|cgi)(?:\\\\.|$)~i"}, {"name": "REQUEST_URI", "type": "contains", "value": "customize.php"}], "cve": "CVE-2025-39557", "description": "Blocks unrestricted file upload (CWE-434) in Kadence WooCommerce Email Designer import feature. Detects non-JSON file uploads to the customizer import endpoint by inspecting the uploaded filename for dangerous extensions (PHP, PHTML, PHAR, etc.).", "mode": "block", "severity": 9.1, "slug": "kadence-woocommerce-email-designer", "target": "plugin", "versions": "<1.5.15"}, "RULE-CVE-2025-39590-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+~"}, {"name": "ARGS:data[settings][tab_title]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-39590", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39590", "description": "Essential Addons for Elementor <=6.1.9 contributor+ stored XSS via Advanced Tabs tab_title widget setting", "mode": "block", "severity": 6.5, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.9"}, "RULE-CVE-2025-39596-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:qntn_pwd", "type": "exists"}], "cve": "CVE-2025-39596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39596", "description": "Quentn WP <=1.2.8 unauthenticated privilege escalation via qntn_pwd auto-login token (GET)", "method": "GET", "mode": "block", "severity": 9.8, "slug": "quentn-wp", "tags": ["weak-authentication", "privilege-escalation", "unauthenticated", "authentication-bypass"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-39596-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:qntn_pwd", "type": "exists"}], "cve": "CVE-2025-39596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39596", "description": "Quentn WP <=1.2.8 unauthenticated privilege escalation via qntn_pwd auto-login token (POST)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "quentn-wp", "tags": ["weak-authentication", "privilege-escalation", "unauthenticated", "authentication-bypass"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-4054-02": {"action": "init", "conditions": [{"name": "ARGS:highlight", "type": "regex", "value": "~(?:]|]+onerror\\\\s*=|]+onload\\\\s*=|]+src\\\\s*=\\\\s*[\\"\']?javascript:|]+onload\\\\s*=|]+ontoggle\\\\s*=|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=)~i"}], "cve": "CVE-2025-4054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4054", "description": "Relevanssi <=4.24.3 unauthenticated reflected XSS via highlight query parameter", "mode": "block", "severity": 6.1, "slug": "relevanssi", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.24.3"}, "RULE-CVE-2025-4099-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[list_children\\\\b[^\\\\]]*(?:]+\\\\bon)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4099", "description": "List Children <=2.1 Stored XSS via list_children shortcode attributes in content parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "list-children", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-4099-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[list_children\\\\b[^\\\\]]*(?:]+\\\\bon)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4099", "description": "List Children <=2.1 Stored XSS via list_children shortcode attributes in post_content parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "list-children", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-4104-01": {"ajax_action": "fed_login_form_post", "conditions": [{"name": "ARGS:submit", "type": "equals", "value": "register"}, {"name": "ARGS:ID", "type": "exists"}], "cve": "CVE-2025-4104", "method": "POST", "mode": "block", "severity": 9.8, "slug": "frontend-dashboard", "target": "plugin", "versions": "<=2.2.6"}, "RULE-CVE-2025-4127-01": {"ajax_action": "kcSeoMainSettings_action", "conditions": [{"name": "ARGS:site_price_range", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4127", "description": "WP SEO Structured Data Schema <=2.7.11 Stored XSS via site_price_range parameter in kcSeoMainSettings_action AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-seo-structured-data-schema", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-4131-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode attributes in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*<(script|svg|img|iframe)~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode script/tag injection in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*javascript:~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode javascript: protocol in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode event handler in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*<(script|svg|img|iframe)~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode script/tag injection in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*javascript:~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode javascript: protocol in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4133-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_title", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 stored XSS via unescaped post title in plugin dashboard views", "method": "POST", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-ship"}, {"name": "ARGS:postId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via postId parameter on ship page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sShowByDate", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sShowByDate on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-04": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sUserAuthId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sUserAuthId on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-05": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sPostBlogId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sPostBlogId on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-06": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sShowByNetwork", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sShowByNetwork on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4169-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ppc\\\\b[^\\\\]]*(?:moretxt|title)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:]+\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]+\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-4188", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4188", "description": "Abundatrade Plugin <=1.8.01 CSRF to Stored XSS via admin settings page (page=abundatrade)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "abundatrade-plugin", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.8.01"}, "RULE-CVE-2025-4188-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "reorder-simple-image-text-slider-setting"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|svg|img|object|embed|form|details|math)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-4188", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4188", "description": "Abundatrade Plugin <=1.8.01 CSRF to Stored XSS via admin settings page (page=reorder-simple-image-text-slider-setting)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "abundatrade-plugin", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.8.01"}, "RULE-CVE-2025-4203-01": {"action": "init", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count parameter in members listing", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "pagination"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-02": {"action": "init", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset parameter in members listing", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "pagination"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-03": {"ajax_action": "wpforo_get_member_template", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count in wpforo_get_member_template AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-04": {"ajax_action": "wpforo_get_member_template", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset in wpforo_get_member_template AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-05": {"ajax_action": "wpforo_get_overview", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count in wpforo_get_overview AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-06": {"ajax_action": "wpforo_get_overview", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset in wpforo_get_overview AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4206-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "gh_tools"}, {"name": "ARGS:action", "type": "equals", "value": "import_delete"}, {"name": "ARGS:import", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2025-4206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4206", "description": "Groundhogg <=4.1.1.2 authenticated arbitrary file deletion via path traversal in process_import_delete", "method": "GET", "mode": "block", "severity": 7.2, "slug": "groundhogg", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=4.1.1.2"}, "RULE-CVE-2025-4206-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "gh_tools"}, {"name": "ARGS:action", "type": "equals", "value": "export_delete"}, {"name": "ARGS:export", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2025-4206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4206", "description": "Groundhogg <=4.1.1.2 authenticated arbitrary file deletion via path traversal in process_export_delete", "method": "GET", "mode": "block", "severity": 7.2, "slug": "groundhogg", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=4.1.1.2"}, "RULE-CVE-2025-4208-01": {"ajax_action": "get_table_records", "conditions": [{"name": "ARGS:header_params", "type": "regex", "value": "~^\\\\s*(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|file_put_contents|file_get_contents|unlink|rmdir|move_uploaded_file|call_user_func|call_user_func_array|create_function|preg_replace_callback|array_map|array_filter|array_walk|usort|uasort|uksort|parse_str|wp_insert_user|wp_update_user|wp_delete_user|update_option|delete_option|add_option|wp_set_auth_cookie|wp_clear_auth_cookie|wp_mail|wp_remote_get|wp_remote_post|curl_exec|setcookie)\\\\s*$~i"}], "cve": "CVE-2025-4208", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4208", "description": "NEX-Forms <= 8.9.1 authenticated code execution via unsanitized call_user_func callback in flat header_params", "method": "POST", "mode": "block", "severity": 6.3, "slug": "nex-forms-express-wp-form-builder", "tags": ["code-injection", "callback-injection", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-4208-02": {"ajax_action": "get_table_records", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^\\\\s*(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|file_put_contents|file_get_contents|unlink|rmdir|move_uploaded_file|call_user_func|call_user_func_array|create_function|preg_replace_callback|array_map|array_filter|array_walk|usort|uasort|uksort|parse_str|wp_insert_user|wp_update_user|wp_delete_user|update_option|delete_option|add_option|wp_set_auth_cookie|wp_clear_auth_cookie|wp_mail|wp_remote_get|wp_remote_post|curl_exec|setcookie)\\\\s*$~i"}], "cve": "CVE-2025-4208", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4208", "description": "NEX-Forms <= 8.9.1 authenticated code execution via unsanitized call_user_func callback in array-encoded header_params", "method": "POST", "mode": "block", "severity": 6.3, "slug": "nex-forms-express-wp-form-builder", "tags": ["code-injection", "callback-injection", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-4212-01": {"ajax_action": "alg_ajax_file_upload", "conditions": [{"name": "ARGS:alg_checkout_files_upload_uploader", "type": "exists"}], "cve": "CVE-2025-4212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4212", "description": "Checkout Files Upload for WooCommerce <=2.2.1 unauthenticated stored XSS via uploaded filename in alg_ajax_file_upload", "method": "POST", "mode": "block", "severity": 7.2, "slug": "checkout-files-upload-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-4223-01": {"ajax_action": "pagelayer_login_submit", "conditions": [{"name": "ARGS:login_url", "type": "regex", "value": "~(?:]|on(?:error|load|unload|mouseover|mouseout|mousedown|mouseup|mousemove|click|dblclick|focus|blur|change|submit|reset|select|keydown|keyup|keypress|input|beforeunload|resize|scroll|contextmenu|drag|drop|copy|cut|paste|abort|cancel|invalid|toggle|wheel|pointerdown|pointerup|pointermove|pointerover|pointerout|pointercancel)\\\\s*=|javascript\\\\s*:|data:[a-zA-Z+][a-zA-Z0-9+./-]*(?:;[^,]*)?,|vbscript\\\\s*:|%3Cscript|%253Cscript|javascript%3A|%6A%61%76%61%73%63%72%69%70%74)~i"}], "cve": "CVE-2025-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4223", "description": "Pagelayer <=2.0.0 reflected XSS via login_url parameter in pagelayer_login_submit AJAX handler", "mode": "block", "severity": 4.7, "slug": "pagelayer", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-4315-01": {"ajax_action": "cwp_user_data", "conditions": [{"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(?:capabilities|user_level)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via arbitrary user meta update on cwp_user_data AJAX action (wp_capabilities)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4315-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp/v1/~"}, {"name": "ARGS:wp_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via REST API cwp_save_user_fields updating wp_capabilities", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4315-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp/v1/~"}, {"name": "ARGS:wp_user_level", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via REST API cwp_save_user_fields updating wp_user_level", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4334-01": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~^wpr\\\\[[^\\\\]]*\\\\]\\\\[(?:[a-z0-9_]*_)?capabilities\\\\]|^wpr\\\\[[^\\\\]]*\\\\]\\\\[wp_user_level\\\\]~i"}], "cve": "CVE-2025-4334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4334", "description": "Simple User Registration <=6.3 unauthenticated privilege escalation via arbitrary wp_capabilities meta injection in wpr_submit_form", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-registration", "tags": ["privilege-escalation", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.3"}, "RULE-CVE-2025-4367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wpdm_user_dashboard"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdm_user_dashboard\\\\b[^\\\\]]*(?:]*[\\"\']link[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:j\\\\s*a\\\\s*v\\\\s*a\\\\s*s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t\\\\s*:|data\\\\s*:|]|javascript *:)~i"}], "cve": "CVE-2025-4429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4429", "description": "Gearside Developer Dashboard <=1.0.72 unauthenticated reflected XSS via data parameter in gearside_search_theme_files AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "gearside-developer-dashboard", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.72"}, "RULE-CVE-2025-4473-01": {"ajax_action": "fed_ajax_request", "conditions": [{"name": "ARGS:fed_action_hook", "type": "regex", "value": "~^FEDEmail@(update|update_smtp)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4473", "method": "POST", "mode": "block", "severity": 8.8, "slug": "frontend-dashboard", "target": "plugin", "versions": ">=1.5.10 <=2.2.7"}, "RULE-CVE-2025-4474-01": {"ajax_action": "fed_admin_setting_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4474", "method": "POST", "mode": "block", "severity": 8.8, "slug": "frontend-dashboard", "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-4479-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:before_label|after_label)[^:]*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*?(?:<\\\\s*(?:script|iframe|svg|object|embed|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keyup|keydown|keypress|animationend|toggle)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4479", "description": "ElementsKit Lite <=3.5.2 Stored XSS via Image Comparison widget before/after labels through Elementor editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-4523-01": {"ajax_action": "admin_donor_profile_view", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4523", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4523", "description": "IDonate <=2.1.9 missing authorization on admin_donor_profile_view AJAX handler exposes sensitive user data", "mode": "block", "severity": 6.5, "slug": "idonate", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-4579-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-content-security-policy/v1/report(/|\\\\?|&|$)~"}, {"name": "ARGS:csp-report", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|body|video|audio|form|base|style|meta|details|math)[\\\\s/>]|on(?:load|error|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4579", "description": "WP Content Security Plugin <=2.3 unauthenticated Stored XSS via blocked-uri and effective-directive in CSP report REST endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-content-security-policy", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-4593-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:[?#]|$)~i"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[rp_user_data\\\\b[^\\\\]]*\\\\bfield\\\\s*=\\\\s*([\\"\']?)(?:user_email|user_login)\\\\1(?=[\\\\s/\\\\]]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4593", "description": "WP Register Profile With Shortcode <=3.6.2 sensitive information exposure via rp_user_data shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-register-profile-with-shortcode", "tags": ["sensitive-data-exposure", "shortcode", "information-disclosure"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-4593-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/posts(?:/[0-9]+)?/?(?:[?#]|$)|/(?:index\\\\.php)?\\\\?(?:[^#&]*&)*rest_route=/wp/v2/posts(?:/[0-9]+)?/?(?:[&#]|$))~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[rp_user_data\\\\b[^\\\\]]*\\\\bfield\\\\s*=\\\\s*([\\"\']?)(?:user_email|user_login)\\\\1(?=[\\\\s/\\\\]]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4593", "description": "WP Register Profile With Shortcode <=3.6.2 sensitive information exposure via rp_user_data shortcode in REST post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-register-profile-with-shortcode", "tags": ["sensitive-data-exposure", "shortcode", "information-disclosure"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-4594-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[trn-ladder-registration-button[^\\\\]]*(?:]+onerror|]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4594", "description": "Tournamatch <=4.6.1 Stored XSS via trn-ladder-registration-button shortcode attribute in post content (post editor vector)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tournamatch", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.6.1"}, "RULE-CVE-2025-4594-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[trn-ladder-registration-button[^\\\\]]*(?:]+onerror|]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4594", "description": "Tournamatch <=4.6.1 Stored XSS via trn-ladder-registration-button shortcode attribute in post content (REST API vector)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tournamatch", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.6.1"}, "RULE-CVE-2025-4597-01": {"ajax_action": "woo_slide_pro_delete_draft_preview", "conditions": [{"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-4597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4597", "description": "Woo Slider Pro <=1.12 missing authorization on woo_slide_pro_delete_draft_preview AJAX action allows Subscriber+ arbitrary post deletion", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woo-slider-pro-drag-drop-slider-builder-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "arbitrary-post-deletion"], "target": "plugin", "versions": "<=1.12"}, "RULE-CVE-2025-4602-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "get_file"}, {"name": "ARGS:filename", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-4602", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4602", "description": "Store Manager Connector <=1.2.5 unauthenticated arbitrary file read via get_file filename path traversal", "mode": "block", "severity": 7.5, "slug": "store-manager-connector", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-4602-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "get_file"}, {"name": "ARGS:entity_type", "type": "regex", "value": "~^(?:\\\\.|\\\\.\\\\.)$|(?:\\\\.\\\\.[/\\\\\\\\])~"}], "cve": "CVE-2025-4602", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4602", "description": "Store Manager Connector <=1.2.5 unauthenticated arbitrary file read via get_file entity_type directory escape", "mode": "block", "severity": 7.5, "slug": "store-manager-connector", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-4608-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sc_fs_local_business\\\\b[^\\\\]]*(?:]+onerror|]*on|]+onerror|]*on|]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4611", "description": "Slim SEO <=4.5.3 Stored XSS via slim_seo_breadcrumbs shortcode attributes in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "slim-seo", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.3"}, "RULE-CVE-2025-4611-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[slim_seo_breadcrumbs\\\\s[^\\\\]]*(?:separator|label_home|label_search|label_404)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/][^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4611", "description": "Slim SEO <=4.5.3 Stored XSS via slim_seo_breadcrumbs shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "slim-seo", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.5.3"}, "RULE-CVE-2025-46244-01": {"ajax_action": "dsalv_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "method": "POST", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46244-02": {"ajax_action": "dsalv_add_new_variation", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "method": "POST", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46244-03": {"ajax_action": "dsalv_searchalltags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46254-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:vcv-settings", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-46254", "description": "Visual Composer Website Builder <=45.10.0 contributor+ stored XSS via vcv-settings element attributes", "method": "POST", "mode": "block", "severity": 6.5, "slug": "visualcomposer", "target": "plugin", "versions": "<=45.10.0"}, "RULE-CVE-2025-46490-01": {"ajax_action": "ccpuz_save_crossword_mce_from", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-46490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-46490", "description": "Crossword Compiler Puzzles <=5.2 subscriber+ arbitrary file upload via ccpuz_save_crossword_mce_from AJAX handler", "mode": "block", "severity": 9.9, "slug": "crossword-compiler-puzzles", "tags": ["arbitrary-file-upload", "missing-authorization", "remote-code-execution"], "target": "plugin", "versions": "<=5.2"}, "RULE-CVE-2025-4652-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~broadstreet/Broadstreet/Vendor/broadstreet-partner/index\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "register"}, {"name": "ARGS:next", "type": "detectXSS"}], "cve": "CVE-2025-4652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4652", "description": "Broadstreet <= 1.51.7 Reflected XSS via unsanitized next parameter in broadstreet-partner index.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "broadstreet", "tags": ["xss", "reflected-xss", "unauthenticated", "direct-file-access"], "target": "plugin", "versions": "<=1.51.7"}, "RULE-CVE-2025-4665-01": {"action": "admin_notices", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~"}, {"name": "ARGS:fid", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4665", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4665", "description": "Contact Form CFDB7 <=1.3.2 authenticated SQL injection and reflected XSS via unsanitized fid parameter in cfdb7_admin_notice (admin_notices hook)", "method": "GET", "mode": "block", "severity": 9.6, "slug": "contact-form-cfdb7", "tags": ["sql-injection", "xss", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-4665-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:|%3[Cc]script)~i"}], "cve": "CVE-2025-4665", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4665", "description": "Contact Form CFDB7 <=1.3.2 authenticated reflected XSS via unsanitized REQUEST_URI echoed in CFDB7_List_Table::bulk_actions (admin_init lifecycle fallback)", "method": "GET", "mode": "block", "severity": 9.6, "slug": "contact-form-cfdb7", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-4666-01": {"ajax_action": "zpAccountsViaAJAX", "conditions": [{"name": "ARGS:nickname", "type": "detectXSS"}], "cve": "CVE-2025-4666", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4666", "description": "Zotpress <=7.3.15 Stored XSS via nickname parameter in zpAccountsViaAJAX AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "zotpress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.3.15"}, "RULE-CVE-2025-4667-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_(?:admin_upcoming|past|upcoming)_appointments\\\\b[^\\\\]]*(?:no_results_message|details_link_label)\\\\s*=\\\\s*\\"[^\\"]*<~i"}], "cve": "CVE-2025-4667", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4667", "description": "Simply Schedule Appointments <=1.6.8.30 Stored XSS via shortcode attributes in post_content (post.php vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simply-schedule-appointments", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.8.30"}, "RULE-CVE-2025-4667-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ssa_(?:admin_upcoming|past|upcoming)_appointments\\\\b[^\\\\]]*(?:no_results_message|details_link_label)\\\\s*=\\\\s*\\"[^\\"]*<~i"}], "cve": "CVE-2025-4667", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4667", "description": "Simply Schedule Appointments <=1.6.8.30 Stored XSS via shortcode attributes in content (REST API vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simply-schedule-appointments", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.6.8.30"}, "RULE-CVE-2025-4669-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts)~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\[wpbc\\\\b[^\\\\]]*(?:<[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/[0-9]+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/[0-9]+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4671-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[compare\\\\b[^\\\\]]*operator\\\\s*=\\\\s*[\\"\'][^\\"\']*<\\\\s*/?\\\\s*[a-z!][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [compare] shortcode operator attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*pre\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode pre attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*post\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode post attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[compare\\\\b[^\\\\]]*operator\\\\s*=\\\\s*[\\"\'][^\\"\']*<\\\\s*/?\\\\s*[a-z!][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [compare] shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*(?:pre|post)\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4672-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta GET endpoint reading sensitive user meta (wp_capabilities, session_tokens)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta POST endpoint creating sensitive user meta (wp_capabilities)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta PUT endpoint updating sensitive user meta (wp_capabilities)", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta DELETE endpoint removing sensitive user meta (wp_capabilities)", "method": "DELETE", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/slider"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Slider block HTML attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/post-carousel"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Post Carousel block HTML attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/slider"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Slider block HTML attributes in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/post-carousel"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Post Carousel block HTML attributes in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4685-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\bon(?:error|load|mouse(?:over|out|enter)|focus|blur|click|change|submit|key(?:up|down|press))\\\\s*=~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via event handler injection in block attributes (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4685-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\bon(?:error|load|mouse(?:over|out|enter)|focus|blur|click|change|submit|key(?:up|down|press))\\\\s*=~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via event handler injection in block attributes (admin post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4685-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|applet)\\\\b~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via dangerous tag injection in block attributes (admin post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4691-01": {"ajax_action": "view_request_details", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-02": {"ajax_action": "view_request_details_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details_car booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-03": {"ajax_action": "view_request_details_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details_restau booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-04": {"ajax_action": "view_hotel_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_hotel_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-05": {"ajax_action": "view_car_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_car_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-06": {"ajax_action": "view_restau_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_restau_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-07": {"ajax_action": "approve_cancel_request", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-08": {"ajax_action": "decline_cancel_request", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-09": {"ajax_action": "approve_cancel_request_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request_car", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-10": {"ajax_action": "decline_cancel_request_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request_car", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-11": {"ajax_action": "approve_cancel_request_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request_restau", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-12": {"ajax_action": "decline_cancel_request_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request_restau", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-47452-01": {"ajax_action": "wpvr_file_import", "conditions": [{"name": "FILES:wpvr_import_file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-47452", "description": "WP VR <=8.5.26 authenticated arbitrary file upload via wpvr_file_import AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "wpvr", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=8.5.26"}, "RULE-CVE-2025-47461-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:sfwc_nonce_frontend_edit_subaccount_form", "type": "exists"}, {"name": "ARGS:user", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-47461", "method": "POST", "mode": "block", "severity": 8.8, "slug": "subaccounts-for-woocommerce", "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2025-47461-02": {"ajax_action": "sfwc_frontend_edit_subaccount", "conditions": [{"name": "ARGS:ajax_user_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-47461", "method": "POST", "mode": "block", "severity": 8.8, "slug": "subaccounts-for-woocommerce", "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2025-47549-01": {"ajax_action": "beaf_options_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47549", "description": "BEAF <=4.6.10 authenticated arbitrary file upload via beaf_options_save AJAX handler (missing authorization)", "mode": "block", "severity": 9.1, "slug": "beaf-before-and-after-gallery", "target": "plugin", "versions": "<=4.6.10"}, "RULE-CVE-2025-47549-02": {"ajax_action": "beaf_options_save", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2025-47549", "description": "BEAF <=4.6.10 arbitrary PHP file upload via beaf_options_save AJAX handler (dangerous file type)", "mode": "block", "severity": 9.1, "slug": "beaf-before-and-after-gallery", "target": "plugin", "versions": "<=4.6.10"}, "RULE-CVE-2025-47588-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/awdp/v1/rules(?:/|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[\\"\':,\\\\s])(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace_callback|call_user_func|call_user_func_array|create_function|include|require|include_once|require_once|file_get_contents|file_put_contents|fopen|phpinfo|unserialize)(?:[\\"\':,\\\\s(]|$)~i"}], "cve": "CVE-2025-47588", "description": "Block code injection via REST API POST /awdp/v1/rules/ in aco-woo-dynamic-pricing <= 4.5.9. Prevents PHP callable names from being stored as rule data that later reaches call_user_func sinks.", "mode": "block", "severity": 9.1, "slug": "aco-woo-dynamic-pricing", "target": "plugin", "versions": "<=4.5.9"}, "RULE-CVE-2025-47588-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/awdp/v1/rules/\\\\d+(?:/|$|\\\\?)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[\\"\':,\\\\s])(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace_callback|call_user_func|call_user_func_array|create_function|include|require|include_once|require_once|file_get_contents|file_put_contents|fopen|phpinfo|unserialize)(?:[\\"\':,\\\\s(]|$)~i"}], "cve": "CVE-2025-47588", "description": "Block code injection via REST API PUT /awdp/v1/rules/{id} in aco-woo-dynamic-pricing <= 4.5.9. Covers the update path for the same stored-callback code injection vector.", "mode": "block", "severity": 9.1, "slug": "aco-woo-dynamic-pricing", "target": "plugin", "versions": "<=4.5.9"}, "RULE-CVE-2025-47601-01": {"ajax_action": "maxi_get_option", "conditions": [{"name": "ARGS:option_value", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47601", "method": "POST", "mode": "block", "severity": 8.8, "slug": "maxi-blocks", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2025-47636-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-47636", "description": "List Category Posts <=0.91.0 contributor+ PHP local file inclusion via catlist shortcode template attribute (classic editor)", "mode": "block", "severity": 7.5, "slug": "list-category-posts", "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-47636-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-47636", "description": "List Category Posts <=0.91.0 contributor+ PHP local file inclusion via catlist shortcode template attribute (block editor / REST API)", "mode": "block", "severity": 7.5, "slug": "list-category-posts", "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-47637-01": {"ajax_action": "staggs_get_configuration_form_urls", "conditions": [{"name": "ARGS:contents", "type": "regex", "value": "~<\\\\?(?:php|=|\\\\s)|<%(?:\\\\s|=)|]~i"}], "cve": "CVE-2025-47637", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-47637", "description": "STAGGS <=2.11.0 unauthenticated arbitrary file upload via contents parameter in staggs_get_configuration_form_urls AJAX handler", "mode": "block", "severity": 10.0, "slug": "staggs", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "cwe-434"], "target": "plugin", "versions": "<=2.11.0"}, "RULE-CVE-2025-47688-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/file-manager-advanced/v1/hide-banner(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47688", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-manager-advanced", "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-47688-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/file-manager-advanced/v1/minimize-maximize-banner(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47688", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-manager-advanced", "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-47690-01": {"ajax_action": "adminAllActionsPRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-02": {"ajax_action": "SaveCRMconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-03": {"ajax_action": "saveZohoSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-04": {"ajax_action": "saveSFSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-05": {"ajax_action": "SaveSuiteconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-06": {"ajax_action": "save_apikey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-4774-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~premium-countdown.*?(?:]|]|phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert|preg_replace\\\\s*.*e)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48140-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[metalpriceapi_change\\\\s[^\\\\]]*base\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:[;`$(){}|<>]|phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert|preg_replace\\\\s*.*e)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi_change shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48140-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:wp-admin/(?:post\\\\.php|post-new\\\\.php)|wp-json/|xmlrpc\\\\.php)~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[metalpriceapi_carat\\\\s[^\\\\]]*\\\\bbase\\\\s*=\\\\s*(?:(?!\\\\s+[A-Za-z_][\\\\w-]*\\\\s*=)[^\\\\]])*?(?:[;`$(){}|<>]|\\\\b(?:phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert|create_function|call_user_func|base64_decode|preg_replace)\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi_carat shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48142-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "POST", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "PUT", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-03": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:/|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "POST", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-04": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:/|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "PUT", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48165-01": {"ajax_action": "openai_api_request", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48165", "description": "DELUCKS SEO <=2.6.0 privilege escalation via openai_api_request AJAX action missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delucks-seo", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-48165-02": {"ajax_action": "save_selected_open_ai_prompt_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48165", "description": "DELUCKS SEO <=2.6.0 privilege escalation via save_selected_open_ai_prompt_option AJAX action missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delucks-seo", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-49076-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:theplus_clients_url", "type": "exists"}, {"name": "ARGS:theplus_clients_url", "type": "regex", "value": "~^\\\\s*(javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-49076", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-plus-addons-for-elementor-page-builder", "target": "plugin", "versions": "<=6.2.7"}, "RULE-CVE-2025-49235-01": {"ajax_action": "get_installed_template", "conditions": [{"name": "ARGS:template_id", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49235", "description": "Rometheme for Elementor <=1.6.0 stored XSS via template_id in get_installed_template AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "tags": ["xss", "stored", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-49235-02": {"ajax_action": "template_category", "conditions": [{"name": "ARGS:category", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49235", "description": "Rometheme for Elementor <=1.6.0 stored XSS via category in template_category AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "tags": ["xss", "stored", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-49244-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|style\\\\s*=\\\\s*[\\"\'][^\\"\']*expression\\\\s*\\\\()|<\\\\s*(?:script|iframe|object|embed|svg|math|form|base|link|meta)\\\\b~i"}], "cve": "CVE-2025-49244", "description": "Shortcodes Ultimate <= 7.3.5 - Reflected XSS via su_generator_preview AJAX (shortcode param)", "mode": "block", "severity": 6.5, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.3.5"}, "RULE-CVE-2025-49244-02": {"ajax_action": "su_generator_settings", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|style\\\\s*=\\\\s*[\\"\'][^\\"\']*expression\\\\s*\\\\()|<\\\\s*(?:script|iframe|object|embed|svg|math|form|base|link|meta)\\\\b~i"}], "cve": "CVE-2025-49244", "description": "Shortcodes Ultimate <= 7.3.5 - XSS/Code Execution via su_generator_settings AJAX (shortcode param)", "mode": "block", "severity": 6.5, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.3.5"}, "RULE-CVE-2025-49359-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49359", "description": "shieldgroup theme <= 2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "shieldgroup", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.13"}, "RULE-CVE-2025-49359-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49359", "description": "shieldgroup theme <= 2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "shieldgroup", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.13"}, "RULE-CVE-2025-49360-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49360", "description": "militarology theme <= 1.0.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "militarology", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49360-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49360", "description": "militarology theme <= 1.0.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "militarology", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49361-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49361", "description": "mamita theme <= 1.0.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "mamita", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.9"}, "RULE-CVE-2025-49361-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49361", "description": "mamita theme <= 1.0.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "mamita", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.9"}, "RULE-CVE-2025-49362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49362", "description": "gracioza theme <= 1.0.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gracioza", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49362-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49362", "description": "gracioza theme <= 1.0.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gracioza", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49363-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49363", "description": "kings-queens theme <= 1.1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "kings-queens", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.16"}, "RULE-CVE-2025-49363-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49363", "description": "kings-queens theme <= 1.1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "kings-queens", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.16"}, "RULE-CVE-2025-49364-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49364", "description": "ludos-paradise theme <= 2.1.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ludos-paradise", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.1.3"}, "RULE-CVE-2025-49364-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49364", "description": "ludos-paradise theme <= 2.1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ludos-paradise", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1.3"}, "RULE-CVE-2025-49365-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49365", "description": "jack-well theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "jack-well", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-49365-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49365", "description": "jack-well theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "jack-well", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-49366-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49366", "description": "hanani theme <= 1.2.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hanani", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2025-49366-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49366", "description": "hanani theme <= 1.2.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hanani", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2025-49367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49367", "description": "monyxi theme <= 1.1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "monyxi", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-49367-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49367", "description": "monyxi theme <= 1.1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "monyxi", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-49368-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49368", "description": "palladio theme <= 1.1.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "palladio", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-49368-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49368", "description": "palladio theme <= 1.1.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "palladio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-49369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49369", "description": "lettuce theme <= 1.1.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lettuce", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.7"}, "RULE-CVE-2025-49369-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49369", "description": "lettuce theme <= 1.1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lettuce", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.7"}, "RULE-CVE-2025-49370-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49370", "description": "lymcoin theme <= 1.3.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lymcoin", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-49370-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49370", "description": "lymcoin theme <= 1.3.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lymcoin", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-49371-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49371", "description": "strux theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "strux", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-49371-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49371", "description": "strux theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "strux", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-49408-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/templately/v1/settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49408", "description": "Templately <=3.2.7 sensitive data exposure via unauthenticated access to REST API settings endpoint", "mode": "block", "severity": 10.0, "slug": "templately", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-4943-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v\\\\d+/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in Elementor REST document save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4943-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in wp-admin post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4943-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in elementor_ajax save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4944-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~<(?:script|img|svg|iframe|details|embed|object|video|audio|body|marquee|isindex|form|button|textarea|select|math|meta|link|style|base|source|input)[\\\\s/][^>]*(?:on(?:error|load|click|mouseover|focus|blur|toggle|mouseenter|mouseleave|change|submit|keydown|keyup|keypress|resize|scroll|animat(?:ion(?:end|start|iteration)|ionend)|transition(?:end|run|start))\\\\s*=|src\\\\s*=\\\\s*[\\"\']?javascript:)|]|[\\"\']\\\\s*javascript\\\\s*:[^\\\\s]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4944", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4944", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored XSS via Image Compare widget settings in Elementor save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4944-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~<(?:script|img|svg|iframe|details|embed|object|video|audio|body|marquee|isindex|form|button|textarea|select|math|meta|link|style|base|source|input)[\\\\s/][^>]*(?:on(?:error|load|click|mouseover|focus|blur|toggle|mouseenter|mouseleave|change|submit|keydown|keyup|keypress|resize|scroll|animat(?:ion(?:end|start|iteration)|ionend)|transition(?:end|run|start))\\\\s*=|src\\\\s*=\\\\s*[\\"\']?javascript:)|]|[\\"\']\\\\s*javascript\\\\s*:[^\\\\s]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4944", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4944", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored XSS via Google Maps widget settings in Elementor save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-49924-01": {"ajax_action": "wwpEditWholesaleRole", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49924", "description": "Wholesale Suite \\u2013 WooCommerce Wholesale Prices <=2.2.4.2 privilege escalation via wwpEditWholesaleRole AJAX action", "method": "POST", "mode": "block", "severity": 7.3, "slug": "woocommerce-wholesale-prices", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.4.2"}, "RULE-CVE-2025-49941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49941", "description": "glamchic theme <= 1.0.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "glamchic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-49941-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49941", "description": "glamchic theme <= 1.0.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "glamchic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-49942-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49942", "description": "gardis theme <= 1.2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gardis", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2025-49942-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49942", "description": "gardis theme <= 1.2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gardis", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2025-49943-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49943", "description": "femme theme <= 1.3.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "femme", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-49943-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49943", "description": "femme theme <= 1.3.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "femme", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-49950-01": {"ajax_action": "wc_billingo_generate_invoice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49950", "description": "Official Integration for Billingo <=4.2.5 missing authorization on wc_billingo_generate_invoice AJAX action allowing authenticated privilege escalation", "method": "POST", "mode": "block", "severity": 7.3, "slug": "billingo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2025-49950-02": {"ajax_action": "wc_billingo_storno_invoice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49950", "description": "Official Integration for Billingo <=4.2.5 missing authorization on wc_billingo_storno_invoice AJAX action allowing authenticated privilege escalation", "method": "POST", "mode": "block", "severity": 7.3, "slug": "billingo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2025-49960-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "leadbi_update_options"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:leadbi_api_key", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-49960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49960", "description": "LeadBI Plugin for WordPress <=1.7 stored XSS via unsanitized plugin option update (leadbi_api_key)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "leadbi", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2025-49960-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "leadbi_update_options"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:leadbi_api_secret", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-49960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49960", "description": "LeadBI Plugin for WordPress <=1.7 stored XSS via unsanitized plugin option update (leadbi_api_secret)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "leadbi", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2025-50003-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-50003", "description": "amuli theme <= 2.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "amuli", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.3.0"}, "RULE-CVE-2025-50003-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-50003", "description": "amuli theme <= 2.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "amuli", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.3.0"}, "RULE-CVE-2025-5018-01": {"ajax_action": "hs_update_ai_chat_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hs_update_ai_chat_settings AJAX handler allows authenticated users to overwrite AI chat configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5018-02": {"ajax_action": "hive_lite_support_get_all_binbox", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hive_lite_support_get_all_binbox AJAX handler allows authenticated users to read sensitive inbox configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5018-03": {"ajax_action": "hs_get_ai_chat_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hs_get_ai_chat_settings AJAX handler allows authenticated users to read OpenAI API key and AI configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5035-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~title\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5035", "description": "Easy FancyBox <=2.3.15 stored XSS via unsanitized anchor title attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.3.15"}, "RULE-CVE-2025-5035-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~title\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5035", "description": "Easy FancyBox <=2.3.15 stored XSS via unsanitized anchor title attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "contributor-plus", "rest-api"], "target": "plugin", "versions": "<=2.3.15"}, "RULE-CVE-2025-5058-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "set_image"}, {"name": "ARGS:image_id", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm)~i"}], "cve": "CVE-2025-5058", "method": "POST", "mode": "block", "severity": 9.8, "slug": "store-manager-connector", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5058-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "set_file"}, {"name": "ARGS:filename", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm)~i"}], "cve": "CVE-2025-5058", "method": "POST", "mode": "block", "severity": 9.8, "slug": "store-manager-connector", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5071-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp/v1/messages(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5071", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-engine", "target": "plugin", "versions": ">=2.8.0 <=2.8.3"}, "RULE-CVE-2025-5071-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp/v1/sse(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5071", "method": "GET", "mode": "block", "severity": 8.8, "slug": "ai-engine", "target": "plugin", "versions": ">=2.8.0 <=2.8.3"}, "RULE-CVE-2025-5082-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~attachmentEditIframe\\\\.php~"}, {"name": "ARGS:attachment_id", "type": "detectXSS"}], "cve": "CVE-2025-5082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5082", "description": "WP Attachments <=5.0.12 reflected XSS via attachment_id parameter in attachmentEditIframe.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-attachments", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.12"}, "RULE-CVE-2025-5083-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "wpgov_at_options"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|body|marquee|input|button|select|textarea|form|meta|link|style|base)[\\\\s/>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5083", "description": "Amministrazione Trasparente <=9.0.2 authenticated stored XSS via plugin settings (wpgov_at_options) print_r output", "method": "POST", "mode": "block", "severity": 5.5, "slug": "amministrazione-trasparente", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=9.0.2"}, "RULE-CVE-2025-5083-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "wpgov_at_option_groups"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|body|marquee|input|button|select|textarea|form|meta|link|style|base)[\\\\s/>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5083", "description": "Amministrazione Trasparente <=9.0.2 authenticated stored XSS via group configuration (wpgov_at_option_groups) print_r output", "method": "POST", "mode": "block", "severity": 5.5, "slug": "amministrazione-trasparente", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=9.0.2"}, "RULE-CVE-2025-5084-01": {"ajax_action": "asr_filter_posts", "conditions": [{"name": "ARGS:argsArray[read_more_text]", "type": "regex", "value": "~<[^>]*[\\\\s/]on\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|svg|math|base|link|meta|style|form|input|select|textarea|details|body|marquee)\\\\b|javascript\\\\s*:~i"}], "cve": "CVE-2025-5084", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5084", "description": "Post Grid Master <=3.4.13 reflected XSS via argsArray[read_more_text] in asr_filter_posts AJAX handler", "mode": "block", "severity": 6.1, "slug": "ajax-filter-posts", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.4.13"}, "RULE-CVE-2025-5096-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_caption]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_caption table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_s_title]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_s_title table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_footer]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_footer table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_s_content_padding]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_s_content_padding table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5116-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_html(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_html REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_query(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_query REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_data REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-04": {"ajax_action": "async_wppic_shortcode_content", "conditions": [{"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 stored XSS via containerid parameter in async shortcode AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5117-01": {"action": "init", "conditions": [{"name": "ARGS:iv-submit-listing", "type": "equals", "value": "register"}, {"name": "ARGS:payment_gateway", "type": "equals", "value": "paypal"}, {"name": "ARGS:package_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5117", "method": "POST", "mode": "block", "severity": 8.8, "slug": "property", "target": "plugin", "versions": ">=1.0.5 <=1.0.6"}, "RULE-CVE-2025-5117-02": {"action": "init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "iv_payment"}, {"name": "ARGS:property_package_user_role", "type": "regex", "value": "~(?:^|\\\\s)(?:administrator|editor|admin)(?:\\\\s|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5117", "method": "POST", "mode": "block", "severity": 8.8, "slug": "property", "target": "plugin", "versions": ">=1.0.5 <=1.0.6"}, "RULE-CVE-2025-5122-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts(?:/|\\\\?|$)|(?:^|[?&])rest_route=/wp/v2/posts(?:/|[?&]|$))~"}, {"name": "ARGS:content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5122-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5122-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|(?:^|[?&])rest_route=/wp/v2/posts/\\\\d+(?:/|[?&]|$))~"}, {"name": "ARGS:content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5144-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "tribe_events"}, {"name": "ARGS:post_content", "type": "regex", "value": "~data-(?:date[a-z-]*|provide)\\\\s*=[^>]*(?:<\\\\s*script|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5144", "description": "The Events Calendar <=6.13.2 Stored XSS via data-date-* attributes in event post content (wp-admin post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-events-calendar", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=6.13.2"}, "RULE-CVE-2025-5234-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in REST API post create/update", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5234-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in REST API post update (PUT)", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5234-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in classic editor post.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5237-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[brid[^\\\\]]*(?:width|height)\\\\s*=\\\\s*[^\\\\]]*(?:on\\\\w+\\\\s*=||on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5239", "description": "Domain For Sale <=3.0.10 Authenticated (Contributor+) Stored XSS via class_name parameter in Gutenberg block post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "domain-for-sale", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.0.10"}, "RULE-CVE-2025-5240-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[vCita(?:MeetingScheduler|ContactForm)[^\\\\]]*type\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-5240", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5240", "description": "CRM and Lead Management by vcita <=2.7.5 Stored XSS via type shortcode attribute in vCitaMeetingScheduler/vCitaContactForm", "method": "POST", "mode": "block", "severity": 6.4, "slug": "crm-customer-relationship-management-by-vcita", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-5240-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[vCitaSchedulingCalendar[^\\\\]]*type\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-5240", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5240", "description": "CRM and Lead Management by vcita <=2.7.5 Stored XSS via type shortcode attribute in vCitaSchedulingCalendar", "method": "POST", "mode": "block", "severity": 6.4, "slug": "crm-customer-relationship-management-by-vcita", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-5258-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:\\\\[conf_scheduler[^\\\\]]*className\\\\s*=\\\\s*[\\"\'][^\\"\']*|conf-scheduler/display[^}]*className[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*)(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|<[a-z/])~i"}], "cve": "CVE-2025-5258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5258", "description": "Conference Scheduler <=2.5.1 Stored XSS via className attribute in shortcode/block (classic editor vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "conference-scheduler", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2025-5259-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:minimal-share-buttons|msb_share)[^>\\\\]]{0,200}align\\\\s*\\"?\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]{0,20}[^\\\\]]{0,80}(?:\\\\]]{0,200}align\\\\s*\\"?\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]{0,20}[^\\\\]]{0,80}(?:]*\\\\bonerror\\\\s*=|<\\\\s*svg\\\\b[^>]*\\\\bonload\\\\s*=|<\\\\s*iframe\\\\b|\\\\bsrc\\\\s*=\\\\s*[\'\\\\\\"]?\\\\s*javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|change|submit|keydown|keyup|keypress|dblclick|contextmenu|wheel|pointerdown|animationend|toggle|resize)\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-5290", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5290", "description": "Borderless \\u2013 Elementor Addons and Templates <=1.7.1 Authenticated (Contributor+) Stored XSS via Elementor widget title settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "borderless", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-5304-01": {"ajax_action": "wpnb_pto_new_users_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5304-02": {"ajax_action": "wpnb_pto_users_deletd", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5304-03": {"ajax_action": "wpnb_pto_new_email_system_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5314-01": {"action": "init", "conditions": [{"name": "ARGS:pdf-source", "type": "regex", "value": "~(?:]|j[^a-z]*a[^a-z]*v[^a-z]*a[^a-z]*s[^a-z]*c[^a-z]*r[^a-z]*i[^a-z]*p[^a-z]*t[^a-z]*:|on(?:load|error|mouseover|click|focus|blur)[ ]*=|<(?:img|svg|iframe|embed|object)[ /][^>]*on[a-z]+=)~i"}], "cve": "CVE-2025-5314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5314", "description": "Dear Flipbook <=2.3.65 DOM-Based Reflected XSS via pdf-source query parameter", "mode": "block", "severity": 6.1, "slug": "3d-flipbook-dflip-lite", "tags": ["xss", "dom-based-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.65"}, "RULE-CVE-2025-53303-01": {"ajax_action": "import_content_xml", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_content_xml AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-02": {"ajax_action": "import_demo", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_demo AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-03": {"ajax_action": "import_widgets_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_widgets_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-04": {"ajax_action": "import_customizer_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_customizer_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-05": {"ajax_action": "import_page_options_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_page_options_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-06": {"ajax_action": "import_elementor_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_elementor_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-07": {"ajax_action": "import_menus_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_menus_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-08": {"ajax_action": "import_woocommerce_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_woocommerce_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-09": {"ajax_action": "import_ess_grid_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_ess_grid_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-10": {"ajax_action": "import_rev_sliders_txt", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_rev_sliders_txt AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-11": {"ajax_action": "import_instagram_feed_txt", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_instagram_feed_txt AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-12": {"ajax_action": "download_media_package", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 unauthorized access via download_media_package AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-5336-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ht[_-]ctc[_-]chat\\\\b[^\\\\]]*\\\\bno_number\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|&#x?[0-9a-f]+;)~i"}], "cve": "CVE-2025-5336", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5336", "description": "Click to Chat for WhatsApp <=4.22 Stored DOM-Based XSS via shortcode no_number attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.22"}, "RULE-CVE-2025-5337-01": {"ajax_action": "ms_save_slideshow", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:on\\\\w+\\\\s*=)|<(?:script|img|svg|iframe|object|embed|video|audio|source|link|meta|base|form|details)\\\\b|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5337", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5337", "description": "MetaSlider <=3.98.0 Stored DOM-Based XSS via aria-label parameter in ms_save_slideshow AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ml-slider", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.98.0"}, "RULE-CVE-2025-5340-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/)~"}, {"name": "ARGS:actions", "type": "regex", "value": "~album_buy_url[^}]{0,80}(?:<[a-z/!][^>]*>|javascript\\\\s*:|data\\\\s*:[^,]*text/html|on(?:error|load|click|mouse)\\\\s*=)~i"}], "cve": "CVE-2025-5340", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5340", "description": "Music Player for Elementor <=2.4.6 authenticated (Contributor+) Stored XSS via album_buy_url widget setting", "method": "POST", "mode": "block", "severity": 6.4, "slug": "music-player-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-5341-01": {"ajax_action": "forminator_save_builder", "conditions": [{"name": "ARGS:structure", "type": "regex", "value": "~(?i)(?:\\\\bon[a-zA-Z]+\\\\s*=|<(?:script|img|svg|iframe|object|embed)[\\\\s/>])~"}], "cve": "CVE-2025-5341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5341", "description": "Forminator <=1.44.1 Authenticated (Contributor+) Stored DOM-Based XSS via rating field configuration in forminator_save_builder", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forminator", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.44.1"}, "RULE-CVE-2025-53428-01": {"ajax_action": "profile_save_field", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-02": {"ajax_action": "profile_save_field", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-03": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-04": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53429-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53429", "description": "exit-game theme <= 1.4.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "exit-game", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-53429-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53429", "description": "exit-game theme <= 1.4.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "exit-game", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-53430-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53430", "description": "etta theme <= 1.14.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "etta", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.14.0"}, "RULE-CVE-2025-53430-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53430", "description": "etta theme <= 1.14.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "etta", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.14.0"}, "RULE-CVE-2025-53431-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53431", "description": "emberlyn theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "emberlyn", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-53431-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53431", "description": "emberlyn theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "emberlyn", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-53432-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53432", "description": "echo theme <= 1.15.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "echo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15.0"}, "RULE-CVE-2025-53432-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53432", "description": "echo theme <= 1.15.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "echo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15.0"}, "RULE-CVE-2025-53433-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53433", "description": "easyeat theme <= 1.9.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "easyeat", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9.0"}, "RULE-CVE-2025-53433-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53433", "description": "easyeat theme <= 1.9.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "easyeat", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9.0"}, "RULE-CVE-2025-53434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53434", "description": "childhope theme <= 1.1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "childhope", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-53434-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53434", "description": "childhope theme <= 1.1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "childhope", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-53435-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53435", "description": "planmyday theme <= 1.1.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "planmyday", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-53435-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53435", "description": "planmyday theme <= 1.1.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "planmyday", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-53438-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53438", "description": "fitline theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fitline", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-53438-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53438", "description": "fitline theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fitline", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-53439-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53439", "description": "harper theme <= 1.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "harper", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.13"}, "RULE-CVE-2025-53439-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53439", "description": "harper theme <= 1.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "harper", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.13"}, "RULE-CVE-2025-53441-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53441", "description": "greeny theme <= 2.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "greeny", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2025-53441-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53441", "description": "greeny theme <= 2.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "greeny", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2025-53442-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53442", "description": "rentic theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rentic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53442-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53442", "description": "rentic theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rentic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53443-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53443", "description": "smash theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "smash", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-53443-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53443", "description": "smash theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "smash", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-53445-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53445", "description": "catwalk theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "catwalk", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-53445-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53445", "description": "catwalk theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "catwalk", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-53446-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53446", "description": "beautique theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "beautique", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2025-53446-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53446", "description": "beautique theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "beautique", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2025-53447-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53447", "description": "assembly theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "assembly", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53447-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53447", "description": "assembly theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "assembly", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53448-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53448", "description": "rally theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rally", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53448-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53448", "description": "rally theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rally", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53449-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53449", "description": "convex theme <= 1.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "convex", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.11"}, "RULE-CVE-2025-53449-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53449", "description": "convex theme <= 1.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "convex", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.11"}, "RULE-CVE-2025-53453-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53453", "description": "hygia theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hygia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-53453-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53453", "description": "hygia theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hygia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-53454-01": {"action": "save_post", "conditions": [{"name": "ARGS:ewd_uwpm_email_content", "type": "detectXSS"}], "cve": "CVE-2025-53454", "method": "POST", "mode": "block", "severity": 6.5, "slug": "ultimate-wp-mail", "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2025-5391-01": {"ajax_action": "wcpo_delete_purchase_order_file", "conditions": [{"name": "ARGS:file_path", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}~"}], "cve": "CVE-2025-5391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5391", "description": "WooCommerce Purchase Orders <=1.0.2 authenticated arbitrary file deletion via path traversal in file_path parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wc-purchase-orders", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-5391-02": {"ajax_action": "wcpo_delete_purchase_order_file", "conditions": [{"name": "ARGS:file_path", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|wp-settings\\\\.php)~i"}], "cve": "CVE-2025-5391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5391", "description": "WooCommerce Purchase Orders <=1.0.2 authenticated sensitive file deletion via file_path parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wc-purchase-orders", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-5398-01": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~<\\\\s*script[^>]*>~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via script tag injection in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-02": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:[{][{].*(?:constructor|prototype|__proto__|eval|Function).*[}][}]|<%[=-]?.*(?:constructor|prototype|__proto__|eval|Function).*%>)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via CSTI template expression in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti", "template-injection"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-03": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:<[^>]{0,400}on(?:load|error|mouseover|click|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|keypress|change|submit|reset|select|abort|contextmenu|dblclick|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|input|invalid|pointerdown|pointerup|toggle)\\\\s*=|href\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via HTML event handler or javascript URI in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "event-handler"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-04": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~<\\\\s*script[^>]*>~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via script tag injection in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-05": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:[{][{].*(?:constructor|prototype|__proto__|eval|Function).*[}][}]|<%[=-]?.*(?:constructor|prototype|__proto__|eval|Function).*%>)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via CSTI template expression in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti", "template-injection"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-06": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:<[^>]{0,400}on(?:load|error|mouseover|click|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|keypress|change|submit|reset|select|abort|contextmenu|dblclick|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|input|invalid|pointerdown|pointerup|toggle)\\\\s*=|href\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via HTML event handler or javascript URI in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "event-handler"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-54003-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-54003", "description": "depot theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "depot", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-54003-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-54003", "description": "depot theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "depot", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-54007-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2025-54007", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54007", "description": "Post Grid and Gutenberg Blocks <=2.3.11 PHP Object Injection via unserialize() of shortcode/block content (CWE-502)", "mode": "block", "severity": 8.8, "slug": "post-grid", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.3.11"}, "RULE-CVE-2025-54010-01": {"ajax_action": "fluent_snippets_import_json", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54010", "description": "FluentSnippets <=10.50 CSRF on snippet import via fluent_snippets_import_json AJAX handler", "mode": "block", "severity": 9.6, "slug": "easy-code-manager", "target": "plugin", "versions": "<=10.50"}, "RULE-CVE-2025-54010-02": {"ajax_action": "fluent_snippets_export_snippets", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54010", "description": "FluentSnippets <=10.50 CSRF on snippet export via fluent_snippets_export_snippets AJAX handler", "mode": "block", "severity": 9.6, "slug": "easy-code-manager", "target": "plugin", "versions": "<=10.50"}, "RULE-CVE-2025-54049-01": {"ajax_action": "mo_caw_enable_disable_api", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54049", "description": "Custom API for WP <=4.2.2 privilege escalation via mo_caw_enable_disable_api AJAX (missing capability check)", "mode": "block", "severity": 9.9, "slug": "custom-api-for-wp", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2025-54049-02": {"ajax_action": "mo_caw_get_api_response", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54049", "description": "Custom API for WP <=4.2.2 privilege escalation via mo_caw_get_api_response AJAX (missing capability check)", "mode": "block", "severity": 9.9, "slug": "custom-api-for-wp", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2025-54049-03": {"ajax_action": "mo_caw_get_nonce", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54049", "description": "Custom API for WP <=4.2.2 nonce leak via mo_caw_get_nonce AJAX enabling privilege escalation (missing capability check)", "mode": "block", "severity": 9.9, "slug": "custom-api-for-wp", "tags": ["privilege-escalation", "missing-authorization", "nonce-leak"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2025-54049-04": {"ajax_action": "mo_caw_get_plugin_version_details", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54049", "description": "Custom API for WP <=4.2.2 information disclosure via mo_caw_get_plugin_version_details AJAX (missing capability check)", "mode": "block", "severity": 9.9, "slug": "custom-api-for-wp", "tags": ["privilege-escalation", "missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2025-54049-05": {"ajax_action": "mo_caw_get_table_columns", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54049", "description": "Custom API for WP <=4.2.2 database schema disclosure via mo_caw_get_table_columns AJAX (missing capability check)", "mode": "block", "severity": 9.9, "slug": "custom-api-for-wp", "tags": ["privilege-escalation", "missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2025-54679-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/ncpc/v1/configs/[0-9]+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54679", "method": "DELETE", "mode": "block", "severity": 7.5, "slug": "neon-channel-product-customizer-free", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-54692-01": {"ajax_action": "wps_membership_save_settings_filter", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wps_membership_save_settings_filter"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54692", "method": "POST", "mode": "block", "slug": "membership-for-woocommerce", "target": "plugin", "versions": "<=2.9.0"}, "RULE-CVE-2025-54710-01": {"ajax_action": "ttp_tiktok_clear", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ttp_tiktok_clear"}, {"name": "ARGS:nonce", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54710", "mode": "block", "severity": 7.1, "slug": "b-tiktok-feed", "target": "plugin", "versions": "<=1.0.21"}, "RULE-CVE-2025-54714-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/zephyr_project_manager/v1/tasks/message(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54714", "method": "POST", "mode": "block", "severity": 7.1, "slug": "zephyr-project-manager", "target": "plugin", "versions": "<=3.3.201"}, "RULE-CVE-2025-54714-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/zephyr_project_manager/v1/tasks/delete(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54714", "method": "POST", "mode": "block", "severity": 7.1, "slug": "zephyr-project-manager", "target": "plugin", "versions": "<=3.3.201"}, "RULE-CVE-2025-54734-01": {"ajax_action": "activated_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-54734-02": {"ajax_action": "get_popular_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-54734-03": {"ajax_action": "get_active_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-5486-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wpmdbug_submit", "type": "exists"}, {"name": "ARGS:wpmdbug_sendto", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5486", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-email-debug", "target": "plugin", "versions": ">=1.0 <=1.2.0"}, "RULE-CVE-2025-5490-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "footballpool-options"}, {"name": "ARGS", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|toggle|focus)\\\\s*=|javascript\\\\s*:|]*>|]*on|]*>|]*>~i"}], "cve": "CVE-2025-5490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5490", "description": "Football Pool <=2.12.4 stored XSS via admin settings page option fields", "method": "POST", "mode": "block", "severity": 4.8, "slug": "football-pool", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=2.12.4"}, "RULE-CVE-2025-5490-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^footballpool-~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|animationend|animationstart|transitionend|pointerover|pointerenter|touchstart|message)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5532", "description": "Campus Directory <=1.9.0 Stored XSS via emd_mb_meta shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "campus-directory", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-5532-02": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS:data[wp_autosave][content]", "type": "contains", "value": "emd_mb_meta"}, {"name": "ARGS:data[wp_autosave][content]", "type": "regex", "value": "~<(?:script|iframe|embed|object|svg|math|link|base)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|animationend|animationstart|transitionend|pointerover|pointerenter|touchstart|message)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5532", "description": "Campus Directory <=1.9.0 Stored XSS via emd_mb_meta shortcode in autosave content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "campus-directory", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-5533-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[kbalert\\\\b~i"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|change|key(?:up|down|press))\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5540", "description": "WP Easy Events <=4.1.0 Authenticated (Contributor+) Stored XSS via emd_mb_meta shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-easy-events", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-5567-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Stored XSS via su_lightbox shortcode src attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5567-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Stored XSS via su_lightbox shortcode src attribute in REST API post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5567-03": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Reflected XSS via su_lightbox shortcode in AJAX preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5568-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_location_venue", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_location_venue field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_street", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_street field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_city", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_city field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_state", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_state field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_postcode", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_postcode field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_country", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_country field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-07": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_name_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_name_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_email_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_email_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-09": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_phone_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_phone_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-10": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_address_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_address_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-11": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_tshirt_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_tshirt_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-12": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_gender_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_gender_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-13": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_company_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_company_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-14": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_desg_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_desg_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-15": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_website_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_website_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-16": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_veg_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_veg_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-17": {"ajax_action": "mep_faq_data_save", "conditions": [{"name": "ARGS:question_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_title in mep_faq_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-18": {"ajax_action": "mep_faq_data_save", "conditions": [{"name": "ARGS:question_answer", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_answer in mep_faq_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-19": {"ajax_action": "mep_faq_data_update", "conditions": [{"name": "ARGS:question_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_title in mep_faq_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-20": {"ajax_action": "mep_faq_data_update", "conditions": [{"name": "ARGS:question_answer", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_answer in mep_faq_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-21": {"ajax_action": "mep_timeline_data_save", "conditions": [{"name": "ARGS:timeline_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_title in mep_timeline_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-22": {"ajax_action": "mep_timeline_data_save", "conditions": [{"name": "ARGS:timeline_desc", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_desc in mep_timeline_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-23": {"ajax_action": "mep_timeline_data_update", "conditions": [{"name": "ARGS:timeline_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_title in mep_timeline_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-24": {"ajax_action": "mep_timeline_data_update", "conditions": [{"name": "ARGS:timeline_desc", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_desc in mep_timeline_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5585-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-url\\\\s*=\\\\s*[\\"\']\\\\s*(?:\\\\{[^}]*[\\"\']\\\\s*(?:url|href)\\\\s*[\\"\']\\\\s*:\\\\s*[\\"\']\\\\s*)?(?:(?:javascript|vbscript)\\\\s*:|data\\\\s*:(?!image/))~i"}], "cve": "CVE-2025-5585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5585", "description": "SiteOrigin Widgets Bundle <=1.68.5 Stored XSS via javascript: URI in Slider widget data-url attribute (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=1.68.5"}, "RULE-CVE-2025-5585-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-url\\\\s*=\\\\s*[\\"\']\\\\s*(?:\\\\{[^}]*[\\"\']\\\\s*(?:url|href)\\\\s*[\\"\']\\\\s*:\\\\s*[\\"\']\\\\s*)?(?:(?:javascript|vbscript)\\\\s*:|data\\\\s*:(?!image/))~i"}], "cve": "CVE-2025-5585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5585", "description": "SiteOrigin Widgets Bundle <=1.68.5 Stored XSS via javascript: URI in Slider widget data-url attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "tags": ["xss", "stored-xss", "rest-api", "contributor-plus"], "target": "plugin", "versions": "<=1.68.5"}, "RULE-CVE-2025-5588-01": {"action": "init", "conditions": [{"name": "ARGS:download", "type": "detectXSS"}], "cve": "CVE-2025-5588", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5588", "description": "Image Editor by Pixo <=2.3.6 Authenticated (Contributor+) Stored XSS via download parameter in [pixoeditor] shortcode", "mode": "block", "severity": 6.4, "slug": "image-editor-by-pixo", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.3.6"}, "RULE-CVE-2025-5673-01": {"action": "admin_init", "conditions": [{"name": "ARGS:prgSortPostType", "type": "regex", "value": "~(?:\'|--|/[*]|UNION[^a-zA-Z0-9]+(?:ALL[^a-zA-Z0-9]+)?SELECT)~i"}], "cve": "CVE-2025-5673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5673", "description": "Blog2Social <= 8.4.4 authenticated SQL injection via prgSortPostType parameter on admin page render", "method": "GET", "mode": "block", "severity": 6.5, "slug": "blog2social", "tags": ["sql-injection", "authenticated", "subscriber-plus"], "target": "plugin", "versions": "<=8.4.4"}, "RULE-CVE-2025-5673-02": {"ajax_action": "b2s_sort_data", "conditions": [{"name": "ARGS:prgSortPostType", "type": "regex", "value": "~(?:\'|--|/[*]|UNION[^a-zA-Z0-9]+(?:ALL[^a-zA-Z0-9]+)?SELECT)~i"}], "cve": "CVE-2025-5673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5673", "description": "Blog2Social <= 8.4.4 authenticated SQL injection via prgSortPostType parameter on b2s_sort_data AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "blog2social", "tags": ["sql-injection", "authenticated", "subscriber-plus"], "target": "plugin", "versions": "<=8.4.4"}, "RULE-CVE-2025-5678-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/countdown[^}]*redirectURL[^}]*(?:javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-5678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5678", "description": "Kadence Blocks <=3.5.10 Stored XSS via Countdown block redirectURL attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.5.10"}, "RULE-CVE-2025-5678-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/countdown[^}]*redirectURL[^}]*(?:javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-5678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5678", "description": "Kadence Blocks <=3.5.10 Stored XSS via Countdown block redirectURL attribute (Classic Editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.5.10"}, "RULE-CVE-2025-5684-01": {"ajax_action": "metform_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]|javascript\\\\s*:|on(?:error|load|toggle|click|mouseover|focus|blur|change|submit|reset|select|abort|drag|drop|input|invalid|play|seeking|stalled|wheel)\\\\s*=~i"}], "cve": "CVE-2025-5684", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5684", "description": "MetForm <= 4.0.1 Authenticated (Contributor+) Stored XSS via metform_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "metform", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-5684-02": {"ajax_action": "mf_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]|javascript\\\\s*:|on(?:error|load|toggle|click|mouseover|focus|blur|change|submit|reset|select|abort|drag|drop|input|invalid|play|seeking|stalled|wheel)\\\\s*=~i"}], "cve": "CVE-2025-5684", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5684", "description": "MetForm <= 4.0.1 Authenticated (Contributor+) Stored XSS via mf_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "metform", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-5692-01": {"ajax_action": "SaveCRMconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on SaveCRMconfig AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-02": {"ajax_action": "SaveSuiteconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on SaveSuiteconfig AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-03": {"ajax_action": "saveZohoSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveZohoSettings AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-04": {"ajax_action": "saveSFSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveSFSettings AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-05": {"ajax_action": "adminAllActionsPRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on adminAllActionsPRO AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-06": {"ajax_action": "Sync_settings_PRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on Sync_settings_PRO AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-07": {"ajax_action": "captcha_info", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on captcha_info AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-08": {"ajax_action": "droptable_info", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on droptable_info AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-09": {"ajax_action": "TFA_auth_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on TFA_auth_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-10": {"ajax_action": "save_apikey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_apikey AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-11": {"ajax_action": "createnew_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on createnew_form AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-12": {"ajax_action": "save_convert_lead", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_convert_lead AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-13": {"ajax_action": "save_campaign_details", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_campaign_details AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-14": {"ajax_action": "import_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on import_file AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-15": {"ajax_action": "file_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on file_import AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-16": {"ajax_action": "download_json", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on download_json AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "data-exfiltration"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-17": {"ajax_action": "wp_usersync_assignedto", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on wp_usersync_assignedto AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-18": {"ajax_action": "mappingmodulepro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on mappingmodulepro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-19": {"ajax_action": "saveSyncValue", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveSyncValue AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-20": {"ajax_action": "send_mapping_configuration", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on send_mapping_configuration AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-21": {"ajax_action": "get_thirdparty_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on get_thirdparty_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-22": {"ajax_action": "map_thirdparty_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_thirdparty_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-23": {"ajax_action": "save_thirdparty_form_title", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_thirdparty_form_title AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-24": {"ajax_action": "send_mapped_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on send_mapped_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-25": {"ajax_action": "delete_mapped_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on delete_mapped_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-26": {"ajax_action": "zohoCRMRedirect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on zohoCRMRedirect AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-27": {"ajax_action": "save_usersync_RR_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_usersync_RR_option AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-28": {"ajax_action": "customfieldpro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on customfieldpro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-29": {"ajax_action": "change_ecom_module_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on change_ecom_module_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-30": {"ajax_action": "map_ecom_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_ecom_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-31": {"ajax_action": "map_sync_user_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_sync_user_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-32": {"ajax_action": "selectplugpro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on selectplugpro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5700-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[simple-logo-carousel[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5700", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5700", "description": "Simple Logo Carousel <=1.9.3 Stored XSS via shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-logo-carousel", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.3"}, "RULE-CVE-2025-5720-01": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS:author", "type": "detectXSS"}], "cve": "CVE-2025-5720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5720", "description": "Customer Reviews for WooCommerce <=5.80.2 unauthenticated stored XSS via author parameter in AJAX review submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.80.2"}, "RULE-CVE-2025-5753-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[crevc-calculator[^\\\\]]*link\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:java\\\\s*script\\\\s*(?::|(?:�*58;|�*3a;))|data\\\\s*:|vbscript\\\\s*:|(?:[\\\\s\\"\'`]|�*34;|�*39;|"|�*22;|�*27;)on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5753", "description": "Valuation Calculator <=1.3.2 Stored XSS via [crevc-calculator] shortcode link attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "commercial-real-estate-valuation-calculator", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-5753-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[crevc-calculator[^\\\\]]*link\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:java\\\\s*script\\\\s*(?::|(?:�*58;|�*3a;))|data\\\\s*:|vbscript\\\\s*:|(?:[\\\\s\\"\'`]|�*34;|�*39;|"|�*22;|�*27;)on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5753", "description": "Valuation Calculator <=1.3.2 Stored XSS via [crevc-calculator] shortcode link attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "commercial-real-estate-valuation-calculator", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-5813-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-amazon-product/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-amazon-product/v1/keyword REST route enables arbitrary product creation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-5813-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-urls/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-urls/v1/keyword REST route enables SSRF-style URL fetching", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-5813-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-product/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-product/v1/keyword REST route enables unauthorized product data retrieval", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-58207-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/alt-text-generator/v1/fetch-bulk-alt-text(?:/|$|\\\\?|&)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58207-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/alt-text-generator/v1/delete-bulk-generating-status(?:/|$|\\\\?|&)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58207-03": {"ajax_action": "send_bulk_images", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58225-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58225", "description": "paragon theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "paragon", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-58225-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58225", "description": "paragon theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "paragon", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-5841-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[onyx-poll\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:[\'\\"]\\\\s+on\\\\w+\\\\s*=|=;()\'/\\\\\\\\][^\\"]*\\"~"}], "cve": "CVE-2025-5844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5844", "description": "Radius Blocks <=2.2.1 Stored XSS via subHeadingTagName block attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "radius-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-5844-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "radius-blocks/advanced-heading"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"subHeadingTagName\\"\\\\s*:\\\\s*\\"[^\\"]*[\\\\s<>=;()\'/\\\\\\\\][^\\"]*\\"~"}], "cve": "CVE-2025-5844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5844", "description": "Radius Blocks <=2.2.1 Stored XSS via subHeadingTagName block attribute in admin post editor (content param)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "radius-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-5844-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "radius-blocks/advanced-heading"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\"subHeadingTagName\\"\\\\s*:\\\\s*\\"[^\\"]*[\\\\s<>=;()\'/\\\\\\\\][^\\"]*\\"~"}], "cve": "CVE-2025-5844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5844", "description": "Radius Blocks <=2.2.1 Stored XSS via subHeadingTagName block attribute in admin post editor (post_content param)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "radius-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-5845-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~affr/reviews-grid[^}]*\\"numColumns\\"\\\\s*:\\\\s*\\"[^\\"]*[^0-9\\"][^\\"]*\\"~i"}], "cve": "CVE-2025-5845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5845", "description": "Affiliate Reviews <=1.0.6 Stored XSS via numColumns block attribute in reviews-grid block (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliate-reviews", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2025-5845-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~affr/reviews-table[^}]*\\"numColumns\\"\\\\s*:\\\\s*\\"[^\\"]*[^0-9\\"][^\\"]*\\"~i"}], "cve": "CVE-2025-5845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5845", "description": "Affiliate Reviews <=1.0.6 Stored XSS via numColumns block attribute in reviews-table block (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliate-reviews", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2025-58592-01": {"ajax_action": "trp_get_translations_regular", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2025-58592", "description": "TranslatePress <=2.10.2 unauthenticated PHP object injection via trp_get_translations_regular AJAX handler", "mode": "block", "severity": 8.1, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.10.2"}, "RULE-CVE-2025-58592-02": {"ajax_action": "trp_get_translations_gettext", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2025-58592", "description": "TranslatePress <=2.10.2 unauthenticated PHP object injection via trp_get_translations_gettext AJAX handler", "mode": "block", "severity": 8.1, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.10.2"}, "RULE-CVE-2025-58706-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58706", "description": "woohoo theme <= 1.25 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "woohoo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58706-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58706", "description": "woohoo theme <= 1.25 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "woohoo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58708-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58708", "description": "triple-seven theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "triple-seven", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2025-58708-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58708", "description": "triple-seven theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "triple-seven", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2025-58709-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58709", "description": "legacy theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "legacy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58709-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58709", "description": "legacy theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "legacy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58803-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58803", "description": "algenix theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "algenix", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-58803-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58803", "description": "algenix theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "algenix", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-58879-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58879", "description": "festy theme <= 1.13.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "festy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.13.0"}, "RULE-CVE-2025-58879-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58879", "description": "festy theme <= 1.13.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "festy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.13.0"}, "RULE-CVE-2025-58885-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58885", "description": "pathfinder theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pathfinder", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58885-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58885", "description": "pathfinder theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pathfinder", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58888-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58888", "description": "theflash theme <= 1.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "theflash", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58888-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58888", "description": "theflash theme <= 1.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "theflash", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58889-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58889", "description": "towny theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "towny", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58889-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58889", "description": "towny theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "towny", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58890-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58890", "description": "playful theme <= 1.19.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "playful", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.19.0"}, "RULE-CVE-2025-58890-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58890", "description": "playful theme <= 1.19.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "playful", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.19.0"}, "RULE-CVE-2025-58891-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58891", "description": "sanger theme <= 1.24.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "sanger", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.24.0"}, "RULE-CVE-2025-58891-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58891", "description": "sanger theme <= 1.24.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "sanger", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.24.0"}, "RULE-CVE-2025-58892-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58892", "description": "tourimo theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tourimo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-58892-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58892", "description": "tourimo theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tourimo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-58893-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58893", "description": "alright theme <= 1.6.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "alright", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2025-58893-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58893", "description": "alright theme <= 1.6.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "alright", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2025-58894-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58894", "description": "good-mood theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "good-mood", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58894-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58894", "description": "good-mood theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "good-mood", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58895-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58895", "description": "integro theme <= 1.8.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "integro", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58895-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58895", "description": "integro theme <= 1.8.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "integro", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58896-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58896", "description": "otaku theme <= 1.8.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "otaku", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58896-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58896", "description": "otaku theme <= 1.8.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "otaku", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58898-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58898", "description": "healthhub theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "healthhub", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58898-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58898", "description": "healthhub theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "healthhub", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58899-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58899", "description": "frame theme <= 2.4.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "frame", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.4.0"}, "RULE-CVE-2025-58899-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58899", "description": "frame theme <= 2.4.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "frame", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4.0"}, "RULE-CVE-2025-58900-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58900", "description": "unitravel theme <= 1.4.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "unitravel", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2025-58900-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58900", "description": "unitravel theme <= 1.4.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "unitravel", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2025-58901-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58901", "description": "takeout theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "takeout", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58901-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58901", "description": "takeout theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "takeout", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58923-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58923", "description": "critique theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "critique", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58923-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58923", "description": "critique theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "critique", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58925-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58925", "description": "neptunus theme <= 1.0.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "neptunus", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-58925-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58925", "description": "neptunus theme <= 1.0.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "neptunus", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-58926-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58926", "description": "cerebrum theme <= 1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cerebrum", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58926-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58926", "description": "cerebrum theme <= 1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cerebrum", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58927-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58927", "description": "stallion theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "stallion", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58927-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58927", "description": "stallion theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "stallion", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58928-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58928", "description": "heart theme <= 1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "heart", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58928-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58928", "description": "heart theme <= 1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "heart", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58929-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58929", "description": "pantry theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pantry", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58929-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58929", "description": "pantry theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pantry", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58930-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58930", "description": "fitflex theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fitflex", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58930-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58930", "description": "fitflex theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fitflex", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58931-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58931", "description": "palatio theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "palatio", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58931-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58931", "description": "palatio theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "palatio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58932-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58932", "description": "prisma theme <= 1.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "prisma", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.10"}, "RULE-CVE-2025-58932-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58932", "description": "prisma theme <= 1.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "prisma", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.10"}, "RULE-CVE-2025-58933-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58933", "description": "anubis theme <= 1.25 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "anubis", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58933-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58933", "description": "anubis theme <= 1.25 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "anubis", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58934-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58934", "description": "thegig theme <= 1.18.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "thegig", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.18.0"}, "RULE-CVE-2025-58934-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58934", "description": "thegig theme <= 1.18.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "thegig", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.18.0"}, "RULE-CVE-2025-58935-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58935", "description": "lunna theme <= 1.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lunna", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58935-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58935", "description": "lunna theme <= 1.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lunna", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58936-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58936", "description": "catamaran theme <= 1.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "catamaran", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58936-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58936", "description": "catamaran theme <= 1.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "catamaran", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58937-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58937", "description": "tacticool theme <= 1.0.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tacticool", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.13"}, "RULE-CVE-2025-58937-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58937", "description": "tacticool theme <= 1.0.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tacticool", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.13"}, "RULE-CVE-2025-58940-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58940", "description": "basil theme <= 1.3.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "basil", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-58940-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58940", "description": "basil theme <= 1.3.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "basil", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-58941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58941", "description": "fabric theme <= 1.5.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fabric", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2025-58941-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58941", "description": "fabric theme <= 1.5.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fabric", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2025-58942-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58942", "description": "dwell theme <= 1.7.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dwell", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2025-58942-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58942", "description": "dwell theme <= 1.7.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dwell", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2025-58943-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58943", "description": "agricola theme <= 1.1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "agricola", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-58943-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58943", "description": "agricola theme <= 1.1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "agricola", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-58944-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58944", "description": "manufactory theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "manufactory", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58944-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58944", "description": "manufactory theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "manufactory", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58945-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58945", "description": "ecogrow theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ecogrow", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-58945-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58945", "description": "ecogrow theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ecogrow", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-58946-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58946", "description": "vocal theme <= 1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "vocal", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58946-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58946", "description": "vocal theme <= 1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "vocal", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58947-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58947", "description": "athos theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "athos", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58947-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58947", "description": "athos theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "athos", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58948-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58948", "description": "aromatica theme <= 1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "aromatica", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58948-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58948", "description": "aromatica theme <= 1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "aromatica", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58949-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58949", "description": "spock theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "spock", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58949-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58949", "description": "spock theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "spock", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58950-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58950", "description": "lione theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lione", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58950-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58950", "description": "lione theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lione", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-5921-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "sureforms_entries"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-5921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5921", "description": "SureForms <=1.7.1 reflected XSS via search parameter in admin entries list table", "method": "GET", "mode": "block", "severity": 5.8, "slug": "sureforms", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-5921-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "sureforms_entries"}, {"name": "ARGS:form_id", "type": "detectXSS"}], "cve": "CVE-2025-5921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5921", "description": "SureForms <=1.7.1 reflected XSS via form_id parameter in admin entries list table filter", "method": "GET", "mode": "block", "severity": 5.8, "slug": "sureforms", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-5923-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~game-review-block/game-table[^}]*\\"className\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\\\"|[^\\"])*[\'<>()=]~i"}], "cve": "CVE-2025-5923", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5923", "description": "Game Review Block <=4.8.1 Stored XSS via className block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "game-review-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=4.8.1"}, "RULE-CVE-2025-5923-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~game-review-block/game-table[^}]*\\"className\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\\\"|[^\\"])*[\'<>()=]~i"}], "cve": "CVE-2025-5923", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5923", "description": "Game Review Block <=4.8.1 Stored XSS via className block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "game-review-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=4.8.1"}, "RULE-CVE-2025-5929-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:the-countdown[\\\\s\\\\S]{0,500}clientId\\\\s*\\"?\\\\s*:\\\\s*\\\\\\"[^\\\\\\"]{0,200}(?:])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5929", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5929", "description": "The Countdown <=2.0.1 Stored XSS via clientId block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-countdown", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-5950-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5950-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5950-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5953-01": {"ajax_action": "hrm_insert_employee", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2025-5953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5953", "description": "WP Human Resource Management <=2.2.17 missing authorization on hrm_insert_employee allows authenticated privilege escalation via role parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hrm", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=2.2.17"}, "RULE-CVE-2025-5957-01": {"ajax_action": "guest_support_handler", "conditions": [{"name": "ARGS:request", "type": "equals", "value": "delete_tickets"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5957", "description": "Guest Support <=1.2.2 missing authorization on mass ticket deletion via guest_support_handler AJAX endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "guest-support", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2025-5961-01": {"ajax_action": "wpvivid_upload_import_files", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:php\\\\d*|phtml|phar|shtml|cgi|asp|aspx|jsp|jspx)(?:\\\\x00|%00|$)~i"}], "cve": "CVE-2025-5961", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.116"}, "RULE-CVE-2025-5983-01": {"action": "admin_init", "conditions": [{"name": "ARGS:mtm_meta[type]", "type": "equals", "value": "http-equiv"}, {"name": "ARGS:mtm_meta[value]", "type": "equals", "value": "refresh"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5983", "description": "Meta Tag Manager <3.3 Contributor+ open redirect via http-equiv refresh meta tag injection on post save", "method": "POST", "mode": "block", "severity": 6.5, "slug": "meta-tag-manager", "tags": ["open-redirect", "missing-authorization", "meta-refresh"], "target": "plugin", "versions": "<3.3"}, "RULE-CVE-2025-60041-01": {"ajax_action": "secas_navigate_to_page", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-60041", "mode": "block", "severity": 8.8, "slug": "emails-catch-all", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2025-60042-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60042", "description": "chinchilla theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "chinchilla", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-60042-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60042", "description": "chinchilla theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "chinchilla", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-60043-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60043", "description": "wanderic theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wanderic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60043-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60043", "description": "wanderic theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wanderic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60044-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60044", "description": "fribbo theme <= 1.1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fribbo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-60044-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60044", "description": "fribbo theme <= 1.1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fribbo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-60046-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60046", "description": "heartstar theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "heartstar", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60046-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60046", "description": "heartstar theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "heartstar", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60047-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60047", "description": "ipharm theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ipharm", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60047-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60047", "description": "ipharm theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ipharm", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60048-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60048", "description": "tripster theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tripster", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60048-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60048", "description": "tripster theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tripster", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60049-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60049", "description": "soleil theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "soleil", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-60049-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60049", "description": "soleil theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "soleil", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-60050-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60050", "description": "panda theme <= 1.21 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "panda", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.21"}, "RULE-CVE-2025-60050-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60050", "description": "panda theme <= 1.21 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "panda", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.21"}, "RULE-CVE-2025-60051-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60051", "description": "rareradio theme <= 1.0.15.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rareradio", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15.1"}, "RULE-CVE-2025-60051-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60051", "description": "rareradio theme <= 1.0.15.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rareradio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15.1"}, "RULE-CVE-2025-60052-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60052", "description": "wd theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wd", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-60052-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60052", "description": "wd theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wd", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-60053-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60053", "description": "maxcube theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "maxcube", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-60053-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60053", "description": "maxcube theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "maxcube", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-60054-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60054", "description": "onleash theme <= 1.5.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "onleash", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5.2"}, "RULE-CVE-2025-60054-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60054", "description": "onleash theme <= 1.5.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "onleash", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.2"}, "RULE-CVE-2025-60055-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60055", "description": "fabrica theme <= 1.8.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fabrica", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2025-60055-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60055", "description": "fabrica theme <= 1.8.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fabrica", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2025-60056-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60056", "description": "winger theme <= 1.0.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "winger", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.16"}, "RULE-CVE-2025-60056-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60056", "description": "winger theme <= 1.0.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "winger", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.16"}, "RULE-CVE-2025-60057-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60057", "description": "dj-rainflow theme <= 1.3.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dj-rainflow", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.13"}, "RULE-CVE-2025-60057-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60057", "description": "dj-rainflow theme <= 1.3.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dj-rainflow", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.13"}, "RULE-CVE-2025-60058-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60058", "description": "detailx theme <= 1.10.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "detailx", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.10.0"}, "RULE-CVE-2025-60058-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60058", "description": "detailx theme <= 1.10.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "detailx", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.10.0"}, "RULE-CVE-2025-60060-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60060", "description": "pubzinne theme <= 1.0.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pubzinne", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-60060-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60060", "description": "pubzinne theme <= 1.0.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pubzinne", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-60061-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60061", "description": "kicker theme <= 2.2.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "kicker", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.2.0"}, "RULE-CVE-2025-60061-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60061", "description": "kicker theme <= 2.2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "kicker", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.2.0"}, "RULE-CVE-2025-60063-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60063", "description": "rosalinda theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rosalinda", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60063-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60063", "description": "rosalinda theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rosalinda", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60064-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60064", "description": "renewal theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "renewal", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2025-60064-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60064", "description": "renewal theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "renewal", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2025-60065-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60065", "description": "pinevale theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pinevale", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60065-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60065", "description": "pinevale theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pinevale", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60066-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60066", "description": "katelyn theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "katelyn", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60066-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60066", "description": "katelyn theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "katelyn", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60067", "description": "giardino theme <= 1.1.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "giardino", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-60067-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60067", "description": "giardino theme <= 1.1.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "giardino", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-60195-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpf_create_account"}, {"name": "ARGS:role", "type": "regex", "value": "~^\\\\s*(?:administrator|editor|author)\\\\s*$~i"}], "cve": "CVE-2025-60195", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-60195", "description": "Atarim Visual Collaboration <=4.2.1 unauthenticated privilege escalation via wpf_create_account AJAX action with attacker-supplied role parameter", "method": "POST", "mode": "block", "severity": 9.8, "slug": "atarim-visual-collaboration", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-60245-01": {"action": "init", "conditions": [{"name": "ARGS:submit_account", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2025-60245", "description": "WP User Manager <=2.9.12 authenticated PHP object injection via account form deserialization", "mode": "block", "severity": 9.8, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.12"}, "RULE-CVE-2025-6025-01": {"ajax_action": "apply_tip", "conditions": [{"name": "ARGS:tip", "type": "regex", "value": "~^\\\\s*-~"}], "cve": "CVE-2025-6025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6025", "description": "Order Tip for WooCommerce <=1.5.4 unauthenticated negative tip manipulation via apply_tip AJAX action", "method": "POST", "mode": "block", "severity": 7.5, "slug": "order-tip-woo", "tags": ["improper-input-validation", "business-logic", "unauthenticated"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-6068-01": {"ajax_action": "foogallery_attachment_modal_save", "conditions": [{"name": "ARGS:foogallery", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~]*>[^<]*[^<\\\\s]|\\\\bon(?:error|load|mouseover|focus|click|mouseenter)\\\\s*=\\\\s*[\\"\']|(?:[=\\"\'(\\\\s]|^)\\\\s*javascript\\\\s*:\\\\s*(?:void|alert|confirm|prompt|eval|document|window|fetch|location|[(\\\\[\'\\"]|//)~i"}], "cve": "CVE-2025-6068", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6068", "description": "FooGallery <=2.4.31 Stored XSS via attachment modal save caption fields", "method": "POST", "mode": "block", "severity": 5.4, "slug": "foogallery", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.31"}, "RULE-CVE-2025-6085-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-6085", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6085", "description": "Make (Integromat) Connector <=1.5.10 arbitrary file upload of executable files via REST media endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "integromat-connector", "tags": ["arbitrary-file-upload", "remote-code-execution", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.5.10"}, "RULE-CVE-2025-6184-01": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-6184", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6184", "description": "Tutor LMS Pro <=3.7.0 authenticated SQL injection via order parameter in assignment listing", "method": "GET", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=3.7.0"}, "RULE-CVE-2025-6190-01": {"ajax_action": "rp_user_profile", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6190", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6190", "description": "Realty Portal Agent <=0.3.9 missing authorization on rp_user_profile AJAX handler allows privilege escalation via wp_capabilities meta key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "realty-portal-agent", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=0.3.9"}, "RULE-CVE-2025-6190-02": {"ajax_action": "rp_user_profile", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6190", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6190", "description": "Realty Portal Agent <=0.3.9 missing authorization on rp_user_profile AJAX handler allows privilege escalation via wp_user_level meta key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "realty-portal-agent", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=0.3.9"}, "RULE-CVE-2025-62007-01": {"ajax_action": "bplvf_save_global", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_save_global"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-02": {"ajax_action": "bplvf_delete_user_feedback", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_delete_user_feedback"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-03": {"ajax_action": "bplvf_toggle_resolved", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_toggle_resolved"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-04": {"ajax_action": "bplvf_get_global", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_get_global"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-6201-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[conversion-pixel[^\\\\]]*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6201", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6201", "description": "Pixel Manager for WooCommerce <=1.49.0 Stored XSS via conversion-pixel shortcode attributes in classic editor (REST API JSON body vector not interceptable due to engine limitation)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-google-adwords-conversion-tracking-tag", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.49.0"}, "RULE-CVE-2025-62022-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/buddypress/v1/signups/activate(/|\\\\?|$)~"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^0*[0-9]{1,20}$~"}], "cve": "CVE-2025-62022", "method": "POST", "mode": "block", "severity": 7.5, "slug": "buddypress", "target": "plugin", "versions": "<=14.3.4"}, "RULE-CVE-2025-62022-02": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/buddypress/v1/signups/activate(/|$)~"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^0*[0-9]{1,20}$~"}], "cve": "CVE-2025-62022", "method": "POST", "mode": "block", "severity": 7.5, "slug": "buddypress", "target": "plugin", "versions": "<=14.3.4"}, "RULE-CVE-2025-62065-01": {"ajax_action": "rtm_handle_upload_template", "conditions": [{"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-62065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-62065", "description": "RomethemeKit <=1.6.5 authenticated arbitrary file upload via rtm_handle_upload_template AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2025-6207-01": {"ajax_action": "wpie_tempalte_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6207", "description": "WP Import Export Lite <=3.9.28 authenticated arbitrary file upload via wpie_tempalte_import AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-import-export-lite", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=3.9.28"}, "RULE-CVE-2025-6212-01": {"ajax_action": "uacf7dp_get_table_data", "conditions": [{"name": "ARGS:form_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6212", "description": "Ultimate Addons for Contact Form 7 <=3.5.19 unauthenticated stored XSS via Database module uacf7dp_get_table_data AJAX endpoint \\u2014 defense-in-depth blocking unauthenticated data retrieval", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-addons-for-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=3.5.19"}, "RULE-CVE-2025-6212-02": {"ajax_action": "uacf7dp_view_table_data", "conditions": [{"name": "ARGS:cf7_form_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6212", "description": "Ultimate Addons for Contact Form 7 <=3.5.19 unauthenticated stored XSS via Database module uacf7dp_view_table_data AJAX endpoint \\u2014 defense-in-depth blocking unauthenticated data retrieval", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-addons-for-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=3.5.19"}, "RULE-CVE-2025-6213-01": {"action": "admin_init", "conditions": [{"name": "ARGS:nppp_action", "type": "equals", "value": "preload_single"}], "cve": "CVE-2025-6213", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6213", "description": "FastCGI Cache Purge and Preload for Nginx <=2.1.2 authenticated RCE via command injection in HTTP Referer header on preload_single action", "method": "GET", "mode": "block", "severity": 7.2, "slug": "fastcgi-cache-purge-and-preload-nginx", "tags": ["command-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2025-6213-02": {"action": "admin_init", "conditions": [{"name": "ARGS:nppp_action", "type": "equals", "value": "purge_single"}], "cve": "CVE-2025-6213", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6213", "description": "FastCGI Cache Purge and Preload for Nginx <=2.1.2 authenticated RCE via command injection in HTTP Referer header on purge_single action", "method": "GET", "mode": "block", "severity": 7.2, "slug": "fastcgi-cache-purge-and-preload-nginx", "tags": ["command-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2025-6220-01": {"ajax_action": "uacf7_options_save", "conditions": [{"name": "FILES:file", "type": "exists"}], "cve": "CVE-2025-6220", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6220", "description": "Ultimate Addons for Contact Form 7 <=3.5.12 arbitrary file upload via save_options allowing PHP webshell upload to itinerary-fonts directory", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ultimate-addons-for-contact-form-7", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.5.12"}, "RULE-CVE-2025-6221-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~~i"}], "cve": "CVE-2026-10551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10551", "description": "Breeze Cache <2.5.6 unauthenticated stored XSS via injected HTML-minification noptimize exclusion marker", "mode": "block", "severity": 6.1, "slug": "breeze", "tags": ["stored-xss", "unauthenticated", "html-minification"], "target": "plugin", "versions": "<2.5.6"}, "RULE-CVE-2026-1058-01": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<|�*60;|�*3[cC];)\\\\s*(?:script|img|svg|iframe|object|embed|body|details|video|audio|math|form|input|marquee|a\\\\b)~i"}], "cve": "CVE-2026-1058", "method": "POST", "mode": "block", "severity": 7.1, "slug": "form-maker", "target": "plugin", "versions": "<=1.15.35"}, "RULE-CVE-2026-1058-02": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)[\\\\s>]~i"}], "cve": "CVE-2026-1058", "method": "POST", "mode": "block", "severity": 7.1, "slug": "form-maker", "target": "plugin", "versions": "<=1.15.35"}, "RULE-CVE-2026-1058-03": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:img|svg|body|details|video|audio|math|marquee|input|a\\\\b)[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-1058", "method": "POST", "mode": "block", "severity": 7.1, "slug": "form-maker", "target": "plugin", "versions": "<=1.15.35"}, "RULE-CVE-2026-10580-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wc-hippoo/v1/ext/wp/v2/users(?:/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-10580", "description": "Hippoo Mobile App for WooCommerce <=1.9.4 unauthenticated admin account takeover via cloned REST user endpoint password reset", "mode": "block", "severity": 9.8, "slug": "hippoo", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2026-10580-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wc-hippoo/v1/ext/(?:/|[a-z])~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-10580", "description": "Hippoo Mobile App for WooCommerce <=1.9.4 unauthenticated access to all cloned REST endpoints via /wc-hippoo/v1/ext/ namespace", "mode": "block", "severity": 9.8, "slug": "hippoo", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2026-10586-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/essential-blocks/v1/save_ai_generated_image(?:[/?]|$)~"}, {"name": "ARGS:image_url", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|tftp|ssh2?)://|(?:^https?://)?(?:(?:127\\\\.)|(?:0\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|localhost(?:$|[:/])|\\\\[?::1\\\\]?(?:$|[:/])|\\\\[?::ffff:)|(?:^https?://|^)0x[0-9a-f]+(?:[:/]|$)|(?:^https?://|^)[0-9]{8,10}(?:[:/]|$))~i"}], "cve": "CVE-2026-10586", "description": "Essential Blocks <=6.1.3 authenticated (Author+) SSRF via image_url in save_ai_generated_image REST endpoint", "mode": "block", "severity": 7.2, "slug": "essential-blocks", "target": "plugin", "versions": "<=6.1.3"}, "RULE-CVE-2026-1060-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/adminify/v1/get-addons-list(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1060", "description": "WP Adminify <=4.0.7.7 unauthenticated sensitive information exposure via get-addons-list REST API", "method": "GET", "mode": "block", "severity": 5.3, "slug": "adminify", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.0.7.7"}, "RULE-CVE-2026-1070-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=alex-user-counter~"}, {"name": "ARGS:user_count_info", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1070", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1070", "description": "User Counter <=6.0 CSRF allows attacker to manipulate plugin settings via missing nonce validation", "method": "POST", "mode": "block", "severity": 4.3, "slug": "user-counter", "tags": ["csrf", "cross-site-request-forgery", "missing-authorization"], "target": "plugin", "versions": "<=6.0"}, "RULE-CVE-2026-1071-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_cache_timeout", "type": "regex", "value": "~(?:]*>[\\\\s\\\\S]*?|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_cache_timeout settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_api_timeout", "type": "regex", "value": "~(?:]*>[\\\\s\\\\S]*?|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_api_timeout settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_grace_period_timeout", "type": "regex", "value": "~(?:]*>[\\\\s\\\\S]*?|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_grace_period_timeout settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_google_ads_id", "type": "regex", "value": "~(?:]*>[\\\\s\\\\S]*?|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_google_ads_id settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_google_tagmanager_id", "type": "regex", "value": "~(?:]*>[\\\\s\\\\S]*?|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_google_tagmanager_id settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_special_render_options", "type": "regex", "value": "~(?:]*>[\\\\s\\\\S]*?|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_special_render_options settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_branding", "type": "regex", "value": "~(?:]*>[\\\\s\\\\S]*?|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_branding settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_alternate_subscription_page", "type": "regex", "value": "~(?:]*>[\\\\s\\\\S]*?|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_alternate_subscription_page settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-11": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_redirect_page", "type": "regex", "value": "~(?:]*>[\\\\s\\\\S]*?|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_redirect_page settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-12": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_detail_pagename", "type": "regex", "value": "~(?:]*>[\\\\s\\\\S]*?|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_detail_pagename settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-13": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_detail_redirect_name", "type": "regex", "value": "~(?:]*>[\\\\s\\\\S]*?|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_detail_redirect_name settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1072-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options(?:-general)?\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "keybaseverif"}, {"name": "ARGS:keybaseverif_text", "type": "regex", "value": "~(?:|/>)|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]|]|]*on[a-z]+=)~i"}], "cve": "CVE-2026-1072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1072", "description": "WP Keybase Verification <=1.4.5 CSRF to stored XSS via keybaseverif_text settings update", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-keybase-verification", "tags": ["csrf", "xss", "stored", "settings-update"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-10737-01": {"ajax_action": "cdm_view_file", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-10737", "description": "SP Project & Document Manager <=4.71 unauthenticated file metadata/download link exposure via cdm_view_file AJAX handler", "mode": "block", "severity": 7.5, "slug": "sp-client-document-manager", "target": "plugin", "versions": "<=4.71"}, "RULE-CVE-2026-1074-01": {"ajax_action": "app_bar_settings", "conditions": [{"name": "ARGS:app-bar-features", "type": "regex", "value": "~(?:<[^>]*(?:script|iframe|object|embed|form|input|textarea|button|details|select|video|audio|source|svg|math|base|link|meta|style|applet)|(?:^|[^a-zA-Z0-9_])on(?:load|error|mouseover|mouseout|click|dblclick|focus|blur|change|submit|keydown|keypress|keyup|cut|copy|paste|abort|resize|scroll|pointerover|animationend)[ ]*=|javascript[ ]*:|data[ ]*:[^,]*;[ ]*base64)~i"}], "cve": "CVE-2026-1074", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1074", "description": "WP App Bar <=1.5 unauthenticated stored XSS via app-bar-features parameter in app_bar_settings AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-app-bar", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2026-1082-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options-general\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "title-animator"}, {"name": "ARGS", "type": "regex", "value": "~(?:<(?:script|svg|iframe|embed|object|details|body)[\\\\s/>]|\\\\bon[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1082", "description": "Title Animator <=1.0 reflected XSS via unsanitized REQUEST_URI on settings page", "mode": "block", "severity": 4.3, "slug": "title-animator", "tags": ["xss", "reflected", "csrf"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-10833-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~essential-blocks/table-of-contents[^}]*\\"configurablePrefix\\"\\\\s*:\\\\s*\\"(?:[^\\"\\\\\\\\]|\\\\\\\\.)*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-10833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10833", "description": "Essential Blocks <=6.1.4 stored XSS via configurablePrefix block attribute in Table of Contents block", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.4"}, "RULE-CVE-2026-1084-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^cookie[_-]consent[_-](?:for[_-]developers|settings)$~"}, {"name": "ARGS", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:iframe|svg|embed|object)[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1084", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1084", "description": "Cookie consent for developers <=1.7.1 authenticated (Administrator+) Stored XSS via plugin settings fields on options.php", "method": "POST", "mode": "block", "severity": 4.4, "slug": "cookie-consent-for-developers", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2026-1085-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~\\\\?page=seolocalrank~"}, {"name": "ARGS:signout", "type": "contains", "value": "1"}, {"name": "capability", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1085", "description": "SEO Local Rank <=2.2.9 CSRF allows attackers to disconnect admin accounts via signout parameter", "mode": "block", "severity": 4.3, "slug": "seo-local-rank", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2026-1095-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "canto_testimonials"}, {"name": "ARGS:post_content", "type": "regex", "value": "~canto_testimonials[^]]*fx *=[^]]*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1095", "description": "Canto Testimonials <=1.0 Stored XSS via shortcode fx attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "canto-testimonials", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1096-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[google_map_view\\\\b[^\\\\]]*\\\\b(?:latitude|longitudinal)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on[a-z]+=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1096", "description": "Best-WP Google Map <=2.1 stored XSS via latitude/longitudinal shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "best-wp-google-map", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2026-1097-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tmauthors\\\\s[^\\\\]]*(?:before|after|separator)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|toggle|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1097", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1097", "description": "ThemeRuby Multi Authors <=1.0.0 Contributor+ stored XSS via tmauthors shortcode before/after/separator attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeruby-multi-authors", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1098-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[css_columns[^\\\\]]*tag\\\\s*=\\\\s*[\\"\'](?:[^\\"\']*[\\\\s<>][^\\"\']*|(?:script|iframe|object|embed|svg|math|style))[\\"\']~i"}], "cve": "CVE-2026-1098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1098", "description": "CM CSS Columns <=1.2.1 Stored XSS via [css_columns] shortcode tag attribute (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cm-css-columns", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-1098-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[css_columns[^\\\\]]*tag\\\\s*=\\\\s*[\\"\'](?:[^\\"\']*[\\\\s<>][^\\"\']*|(?:script|iframe|object|embed|svg|math|style))[\\"\']~i"}], "cve": "CVE-2026-1098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1098", "description": "CM CSS Columns <=1.2.1 Stored XSS via [css_columns] shortcode tag attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cm-css-columns", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-1104-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/packages(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1104", "mode": "block", "severity": 8.8, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-1127-01": {"ajax_action": "timeline_shortcode", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<|>|%3[Cc]|%3[Ee])~"}], "cve": "CVE-2026-1127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1127", "description": "Timeline Event History <=3.2 reflected XSS via id parameter in timeline_shortcode AJAX handler (unauthenticated)", "mode": "block", "severity": 6.1, "slug": "timeline-event-history", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2026-11363-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~i"}, {"name": "ARGS:nf_import_security", "type": "exists"}, {"name": "FILES:nf_import_fields:content", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-11363", "description": "Ninja Forms <=3.14.6 PHP Object Injection via unhardened unserialize() of nf_import_fields upload content in import_fields_listener", "mode": "block", "slug": "ninja-forms", "target": "plugin", "versions": "<=3.14.6"}, "RULE-CVE-2026-11395-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/contact-form-7/v1/contact-forms/[0-9]+/feedback(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~^(?:169\\\\.254\\\\.|127\\\\.0\\\\.0\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|0(?:x[0-9a-f]+|[0-7]+\\\\.)|\\\\[?::1\\\\]?$|0\\\\.0\\\\.0\\\\.0|localhost)~i"}], "cve": "CVE-2026-11395", "description": "CF7 to Webhook <=5.0.0 unauthenticated SSRF via CF7 field placeholder in webhook URL host segment", "mode": "block", "severity": 7.2, "slug": "cf7-to-zapier", "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2026-11426-01": {"action": "init", "conditions": [{"name": "ARGS:template_thumbnail", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|^(?:/|[A-Za-z]:[\\\\\\\\/])|php://|file://|/etc/passwd|wp-config\\\\.php~i"}], "cve": "CVE-2026-11426", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11426", "description": "UnderConstructionPage PRO <=5.76 arbitrary file read via template_thumbnail (path traversal / arbitrary local file path copied into public uploads); NOTE - evidence gap: analyzed plugin tree resolved to FREE tier under-construction-page 4.05/trunk, not the PRO 5.76/5.81 codebase named by NVD/Wordfence, so no code-level hook/sink/capability confirmation exists for this parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "under-construction-page", "tags": ["path-traversal", "arbitrary-file-read", "authenticated", "low-confidence"], "target": "plugin", "versions": "<=5.76"}, "RULE-CVE-2026-11551-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "register"}, {"name": "ARGS:password_1", "type": "exists"}], "cve": "CVE-2026-11551", "description": "Branda <=3.4.29 unauthenticated privilege escalation via account takeover through registration password fields (single-site)", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<=3.4.29"}, "RULE-CVE-2026-11551-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-signup\\\\.php~"}, {"name": "ARGS:signup_password", "type": "exists"}], "cve": "CVE-2026-11551", "description": "Branda <=3.4.29 unauthenticated privilege escalation via multisite signup password fields", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<=3.4.29"}, "RULE-CVE-2026-11571-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-content/uploads/(?:[^/?]+/)*[^/?]*[0-9]{3,}[^/?]*\\\\.csv(?:\\\\?|$)~i"}], "cve": "CVE-2026-11571", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11571", "description": "Everest Forms <3.5.0 unauthenticated disclosure of form submissions via leftover temporary CSV export file in uploads directory", "method": "GET", "mode": "block", "severity": 7.5, "slug": "everest-forms", "tags": ["sensitive-data-exposure", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<3.5.0"}, "RULE-CVE-2026-11589-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "createNewTicket"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:s?html?|svg|xhtml?|xml)$~i"}], "cve": "CVE-2026-11589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11589", "description": "WP Support Plus Responsive Ticket System <=9.1.2 unauthenticated stored XSS via malicious HTML/SVG/HTM file upload in createNewTicket", "mode": "block", "severity": 8.8, "slug": "wp-support-plus-responsive-ticket-system", "tags": ["xss", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2026-1165-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-popup-box"}, {"name": "ARGS:action", "type": "equals", "value": "ays_pb_publish_popupbox"}, {"name": "ARGS:popupbox", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1165", "description": "Popup Box <=6.1.1 CSRF publish popupbox via admin.php action parameter", "method": "GET", "mode": "block", "severity": 4.3, "slug": "ays-popup-box", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-1165-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-popup-box"}, {"name": "ARGS:action", "type": "equals", "value": "ays_pb_unpublish_popupbox"}, {"name": "ARGS:popupbox", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1165", "description": "Popup Box <=6.1.1 CSRF unpublish popupbox via admin.php action parameter", "method": "GET", "mode": "block", "severity": 4.3, "slug": "ays-popup-box", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-1165-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-popup-box"}, {"name": "ARGS:action", "type": "regex", "value": "~^ays_pb_(?:publish|unpublish)_popupbox$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1165", "description": "Popup Box <=6.1.1 CSRF bulk publish/unpublish popupbox via POST", "method": "POST", "mode": "block", "severity": 4.3, "slug": "ays-popup-box", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-1187-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[zoomify\\\\s[^\\\\]]*filename\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|)[^\'\\"]*[\'\\"]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1187", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1187", "description": "ZoomifyWP Free <=1.1 Contributor+ Stored XSS via zoomify shortcode filename attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tz-zoomifywp-free", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-11911-01": {"ajax_action": "simplefilelist_edit_job", "conditions": [{"name": "ARGS:eeSubFolder", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee][\\\\\\\\/]|%2[Ee]%2[Ee]%2[Ff]|%252[Ee]%252[Ee])~i"}], "cve": "CVE-2026-11911", "description": "Simple File List <=6.3.7 unauthenticated arbitrary file deletion via path traversal in eeSubFolder parameter", "mode": "block", "severity": 7.5, "slug": "simple-file-list", "target": "plugin", "versions": "<=6.3.7"}, "RULE-CVE-2026-11911-02": {"ajax_action": "simplefilelist_edit_job", "conditions": [{"name": "ARGS:eeFileName", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee][\\\\\\\\/]|%2[Ee]%2[Ee]%2[Ff]|%252[Ee]%252[Ee])~i"}], "cve": "CVE-2026-11911", "description": "Simple File List <=6.3.7 unauthenticated arbitrary file deletion via path traversal in eeFileName parameter", "mode": "block", "severity": 7.5, "slug": "simple-file-list", "target": "plugin", "versions": "<=6.3.7"}, "RULE-CVE-2026-11961-01": {"action": "init", "conditions": [{"name": "ARGS:member_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-11961", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11961", "description": "User Registration & Membership <5.2.3 unauthorized user deletion via member_id in membership AJAX cleanup path", "mode": "block", "severity": 8.1, "slug": "user-registration", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<5.2.3"}, "RULE-CVE-2026-11962-01": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "regex", "value": "~^(?:mkfile|rename)$~"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp(?:x)?|jsp(?:x)?|cfm)(?:$|[\\"\'\\\\s&])|(?:^|[/\\\\\\\\])\\\\.htaccess(?:$|[\\"\'\\\\s&]))~i"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 authenticated arbitrary executable file creation through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-11962-02": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "put"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\?(?:php\\\\b|=|[\\\\t\\\\r\\\\n ])~i"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 authenticated PHP content write through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-11962-03": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "extract"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 unsafe archive extraction through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-11962-04": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "put"}, {"name": "ARGS:encoding", "type": "regex", "value": "~^(?:scheme|hash)$~"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 encoded content write through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-11964-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/user-registration/paypal-webhook[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:ur-membership-listener", "type": "exists"}, {"name": "ARGS:ur-membership-return", "type": "exists"}], "cve": "CVE-2026-11964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11964", "description": "User Registration & Membership <5.2.2 unauthenticated forged PayPal webhook activates paid membership without payment", "mode": "block", "severity": 9.1, "slug": "user-registration", "tags": ["missing-authorization", "authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<5.2.2"}, "RULE-CVE-2026-11964-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/user-registration/paypal-webhook[\\\\\\\\/]*$~i"}, {"name": "ARGS:ur-membership-listener", "type": "exists"}, {"name": "ARGS:ur-membership-return", "type": "exists"}], "cve": "CVE-2026-11964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11964", "description": "User Registration & Membership <5.2.2 unauthenticated forged PayPal webhook activates paid membership without payment", "mode": "block", "severity": 9.1, "slug": "user-registration", "tags": ["missing-authorization", "authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<5.2.2"}, "RULE-CVE-2026-1206-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "get_template_data"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1206", "description": "Elementor <=3.35.7 contributor+ sensitive information disclosure via get_template_data sub-action on elementor_ajax \\u2014 authorization logic bypass (CWE-639) allows reading private/draft templates", "mode": "block", "severity": 4.3, "slug": "elementor", "tags": ["broken-access-control", "information-disclosure", "idor"], "target": "plugin", "versions": "<=3.35.7"}, "RULE-CVE-2026-1210-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~age[_-]?gate[^}]*(?:desc|footer_text)[^}]*<[^>]*(?:on[a-zA-Z]+=|=4.0 <=5.10 IDOR via load_track_note_ajax exposes private post content (HIGH FP RISK: blocks legitimate anonymous music player usage)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mp3-music-player-by-sonaar", "tags": ["idor", "insecure-direct-object-reference", "unauthenticated"], "target": "plugin", "versions": ">=4.0 <=5.10"}, "RULE-CVE-2026-1219-02": {"ajax_action": "load_post_by_ajax", "conditions": [{"name": "ARGS:post-id", "type": "exists"}], "cve": "CVE-2026-1219", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1219", "description": "MP3 Audio Player by Sonaar >=4.0 <=5.10 IDOR via load_post_by_ajax exposes private post content (HIGH FP RISK: blocks legitimate anonymous music player usage)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mp3-music-player-by-sonaar", "tags": ["idor", "insecure-direct-object-reference", "unauthenticated"], "target": "plugin", "versions": ">=4.0 <=5.10"}, "RULE-CVE-2026-1219-03": {"ajax_action": "load_lyrics_ajax", "conditions": [{"name": "ARGS:post-id", "type": "exists"}], "cve": "CVE-2026-1219", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1219", "description": "MP3 Audio Player by Sonaar >=4.0 <=5.10 IDOR via load_lyrics_ajax exposes private post content (HIGH FP RISK: blocks legitimate anonymous music player usage)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mp3-music-player-by-sonaar", "tags": ["idor", "insecure-direct-object-reference", "unauthenticated"], "target": "plugin", "versions": ">=4.0 <=5.10"}, "RULE-CVE-2026-12238-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpgmza/v1/(?:markers|maps|circles|polygons|polylines|rectangles|point-labels)(?:[/?&]|$)~"}, {"name": "ARGS:phpClass", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-12238", "description": "WP Go Maps <=10.1.01 unauthenticated arbitrary record creation via phpClass parameter on REST CRUD API", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "target": "plugin", "versions": "<=10.1.01"}, "RULE-CVE-2026-12238-02": {"ajax_action": "wpgmza_rest_api_request", "conditions": [{"name": "ARGS:phpClass", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-12238", "description": "WP Go Maps <=10.1.01 unauthenticated arbitrary record creation via phpClass parameter on AJAX fallback endpoint", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "target": "plugin", "versions": "<=10.1.01"}, "RULE-CVE-2026-1231-01": {"action": "wp", "conditions": [{"name": "ARGS:fl_action", "type": "equals", "value": "save_global_settings"}, {"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2026-1231", "method": "POST", "mode": "block", "severity": 6.4, "slug": "beaver-builder-lite-version", "target": "plugin", "versions": "<=2.10.0.5"}, "RULE-CVE-2026-1235-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^wpsc_~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;&])O:\\\\d+:\\"[A-Za-z_]~"}], "cve": "CVE-2026-1235", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-e-commerce", "target": "plugin", "versions": "<3.15.2"}, "RULE-CVE-2026-1236-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/envira(?:/[0-9]+)?(?:[/?]|$)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1236", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1236", "description": "Envira Gallery Lite <=1.12.3 stored XSS via justified_gallery_theme parameter in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "envira-gallery-lite", "tags": ["xss", "stored", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.12.3"}, "RULE-CVE-2026-1236-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_eg_gallery_data[config][justified_gallery_theme]", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\'][\\\\s]*on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1236", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1236", "description": "Envira Gallery Lite <=1.12.3 stored XSS via justified_gallery_theme parameter in post edit form", "method": "POST", "mode": "block", "severity": 6.4, "slug": "envira-gallery-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.12.3"}, "RULE-CVE-2026-1238-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS:fh", "type": "regex", "value": "~(?:]*on[a-z]+\\\\s*=|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2026-1238", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1238", "description": "WP Slimstat <=5.3.5 unauthenticated stored XSS via slimtrack fh parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-slimstat", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.3.5"}, "RULE-CVE-2026-1239-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/token/refresh(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1239", "description": "Ninja Forms <=3.14.1 unauthenticated access to form submissions via ninja-forms-views/token/refresh REST endpoint", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2026-12407-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "e2pdf-templates"}, {"name": "ARGS:action", "type": "equals", "value": "screen"}, {"name": "ARGS:wp_screen_options[option]", "type": "regex", "value": "~^(?!screen_layout_columns$|metaboxhidden_)~"}, {"type": "missing_capability", "value": "e2pdf_templates"}], "cve": "CVE-2026-12407", "description": "E2Pdf <=1.32.26 authenticated arbitrary option update via screen_action() missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "e2pdf", "target": "plugin", "versions": "<=1.32.26"}, "RULE-CVE-2026-12416-01": {"ajax_action": "pravel_invoice_change_password", "conditions": [{"name": "ARGS:reset_user_id", "type": "exists"}], "cve": "CVE-2026-12416", "description": "Invoice Generator <=1.0.0 unauthenticated account takeover via pravel_invoice_change_password AJAX handler with weak reset code validation", "mode": "block", "severity": 9.8, "slug": "invoice-creator", "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-12417-01": {"ajax_action": "pravel_change_password", "conditions": [{"name": "ARGS:reset_user_id", "type": "exists"}, {"name": "ARGS:new_password_custom", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-12417", "description": "SignUp & SignIn <=1.0.0 unauthenticated account takeover via pravel_change_password AJAX handler", "mode": "block", "severity": 9.8, "slug": "signup-signin", "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1244-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[financoop_campaign\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]*)(?:<[a-z/!]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2026-1244", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1244", "description": "Forms Bridge <= 4.2.5 Stored XSS via financoop_campaign shortcode id attribute in post content (wp-admin/post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forms-bridge", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2026-1244-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[financoop_campaign\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]*)(?:<[a-z/!]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2026-1244", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1244", "description": "Forms Bridge <= 4.2.5 Stored XSS via financoop_campaign shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forms-bridge", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2026-1246-01": {"ajax_action": "shortpixel_ajaxRequest", "conditions": [{"name": "ARGS:screen_action", "type": "equals", "value": "loadLogFile"}, {"name": "ARGS:loadFile", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env|(?:^|[\\\\\\\\/])debug\\\\.log$)~i"}], "cve": "CVE-2026-1246", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1246", "description": "ShortPixel Image Optimizer <=6.4.2 authenticated arbitrary file read via path traversal in loadLogFile AJAX sub-action", "method": "POST", "mode": "block", "severity": 4.9, "slug": "shortpixel-image-optimiser", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2026-12470-01": {"ajax_action": "cmp_ajax_import_settings", "conditions": [{"name": "ARGS:json", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-12470", "description": "CMP - Coming Soon & Maintenance Plugin by NiteoThemes <=4.1.17 missing capability check on cmp_ajax_import_settings AJAX action allows Editor-level privilege escalation via arbitrary option update", "mode": "block", "slug": "cmp-coming-soon-maintenance", "target": "plugin", "versions": "<=4.1.17"}, "RULE-CVE-2026-1249-01": {"ajax_action": "load_lyrics_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:post-id", "type": "exists"}], "cve": "CVE-2026-1249", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1249", "description": "MP3 Audio Player by Sonaar <=5.10 authenticated SSRF via load_lyrics_ajax AJAX action", "method": "POST", "mode": "block", "severity": 5.0, "slug": "mp3-music-player-by-sonaar", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=5.10"}, "RULE-CVE-2026-12497-01": {"ajax_action": "pp_ajax_signup", "conditions": [{"name": "ARGS:reg_select_role", "type": "regex", "value": "~^(?:administrator|editor|author)$~i"}], "cve": "CVE-2026-12497", "description": "Paid Membership Plugin (wp-user-avatar) <4.16.18 unauthenticated privilege escalation via reg_select_role in pp_ajax_signup", "mode": "block", "severity": 7.5, "slug": "wp-user-avatar", "target": "plugin", "versions": "<4.16.18"}, "RULE-CVE-2026-1250-01": {"ajax_action": "get_court", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-1250", "description": "Court Reservation <=1.10.11 unauthenticated SQL injection via id parameter in get_court AJAX handler", "mode": "block", "severity": 7.5, "slug": "court-reservation", "target": "plugin", "versions": "<=1.10.11"}, "RULE-CVE-2026-12511-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mwai/v1/ai/images[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~[\\\\\\\\/]~"}], "cve": "CVE-2026-12511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12511", "description": "AI Engine <3.5.5 authenticated (editor+) path traversal via filename in /ai/images REST route write of downloaded image", "mode": "block", "severity": 8.1, "slug": "ai-engine", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.5.5"}, "RULE-CVE-2026-12511-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mwai/v1/ai/images[\\\\\\\\/]*$~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~[\\\\\\\\/]~"}], "cve": "CVE-2026-12511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12511", "description": "AI Engine <3.5.5 authenticated (editor+) path traversal via filename in /ai/images REST route write of downloaded image", "mode": "block", "severity": 8.1, "slug": "ai-engine", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.5.5"}, "RULE-CVE-2026-12511-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mwai/v1/ai/image_edit[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~[\\\\\\\\/]~"}], "cve": "CVE-2026-12511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12511", "description": "AI Engine <3.5.5 authenticated (editor+) path traversal via filename in /ai/image_edit REST route write of downloaded image", "mode": "block", "severity": 8.1, "slug": "ai-engine", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.5.5"}, "RULE-CVE-2026-12511-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mwai/v1/ai/image_edit[\\\\\\\\/]*$~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~[\\\\\\\\/]~"}], "cve": "CVE-2026-12511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12511", "description": "AI Engine <3.5.5 authenticated (editor+) path traversal via filename in /ai/image_edit REST route write of downloaded image", "mode": "block", "severity": 8.1, "slug": "ai-engine", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.5.5"}, "RULE-CVE-2026-1252-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "events_listing"}, {"name": "ARGS:events_listing_url", "type": "regex", "value": "~(?:^[\\\\t\\\\n\\\\r ]*j[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*v[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*s[\\\\t\\\\n\\\\r ]*c[\\\\t\\\\n\\\\r ]*r[\\\\t\\\\n\\\\r ]*i[\\\\t\\\\n\\\\r ]*p[\\\\t\\\\n\\\\r ]*t[\\\\t\\\\n\\\\r ]*:|^[\\\\t\\\\n\\\\r ]*d[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*t[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*:|^[\\\\t\\\\n\\\\r ]*v[\\\\t\\\\n\\\\r ]*b[\\\\t\\\\n\\\\r ]*s[\\\\t\\\\n\\\\r ]*c[\\\\t\\\\n\\\\r ]*r[\\\\t\\\\n\\\\r ]*i[\\\\t\\\\n\\\\r ]*p[\\\\t\\\\n\\\\r ]*t[\\\\t\\\\n\\\\r ]*:|[\\"\'][\\\\t\\\\n\\\\r ]*(?:on[a-zA-Z0-9_]+)[\\\\t\\\\n\\\\r ]*=|<[ ]*(?:script|svg|img|iframe|object|embed|math|details|body|marquee|video|audio|input|button|select|textarea|form|base|link|meta|style)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2026-1252", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1252", "description": "Events Listing Widget <=1.3.4 authenticated (Author+) stored XSS via events_listing_url parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "events-listing-widget", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-1254-01": {"ajax_action": "modula_save_gallery", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1254", "method": "POST", "mode": "block", "severity": 4.3, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<2.14.0"}, "RULE-CVE-2026-1258-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/email/templates(?:[/?&]|$)~"}, {"name": "ARGS:order-type", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order-type parameter on email/templates REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/email/templates(?:[/?&]|$)~"}, {"name": "ARGS:order-by", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order-by parameter on email/templates REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/forms(?:[/?&]|$)~"}, {"name": "ARGS:order_type", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_type parameter on forms REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/forms(?:[/?&]|$)~"}, {"name": "ARGS:order_by", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_by parameter on forms REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/automation(?:[/?&]|$)~"}, {"name": "ARGS:order_type", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_type parameter on automation REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/automation(?:[/?&]|$)~"}, {"name": "ARGS:order_by", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_by parameter on automation REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/contacts/import/tutorlms/map(?:[/?&]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\)\\\\s+(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via selectedCourses parameter on tutorlms import REST endpoint", "method": "POST", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1266-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "postalicious"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1266", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1266", "description": "Postalicious <=3.0.1 authenticated (admin+) stored XSS via plugin settings", "method": "POST", "mode": "block", "severity": 4.4, "slug": "postalicious", "tags": ["xss", "stored", "authenticated", "admin-settings"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1268-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:meta[dwc-content]", "type": "regex", "value": "~(?:]|]|\\\\bon(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1268", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1268", "description": "Dynamic Widget Content <=1.3.6 authenticated (Contributor+) stored XSS via dwc-content post meta on REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-widget-content", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2026-1268-02": {"action": "admin_init", "conditions": [{"name": "ARGS:dwc-content", "type": "regex", "value": "~(?:]|]|\\\\bon(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1268", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1268", "description": "Dynamic Widget Content <=1.3.6 authenticated (Contributor+) stored XSS via dwc-content post meta on classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-widget-content", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2026-1271-01": {"ajax_action": "pm_upload_image", "conditions": [{"name": "ARGS:user_id", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1271", "description": "ProfileGrid <= 5.9.7.2 IDOR via pm_upload_image - virtual patch blocks non-admin profile image uploads to prevent arbitrary user image modification (FP: legitimate subscriber self-uploads blocked until plugin update)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "profilegrid-user-profiles-groups-and-communities", "tags": ["idor", "authorization-bypass", "insecure-direct-object-reference"], "target": "plugin", "versions": "<=5.9.7.2"}, "RULE-CVE-2026-1271-02": {"ajax_action": "pm_upload_cover_image", "conditions": [{"name": "ARGS:user_id", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1271", "description": "ProfileGrid <= 5.9.7.2 IDOR via pm_upload_cover_image - virtual patch blocks non-admin cover image uploads to prevent arbitrary user image modification (FP: legitimate subscriber self-uploads blocked until plugin update)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "profilegrid-user-profiles-groups-and-communities", "tags": ["idor", "authorization-bypass", "insecure-direct-object-reference"], "target": "plugin", "versions": "<=5.9.7.2"}, "RULE-CVE-2026-12713-01": {"ajax_action": "view_shipment_details", "conditions": [{"name": "ARGS:shipmentID", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-12713", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12713", "description": "WPCargo Track & Trace <8.0.4 unauthenticated SQL injection hardening via shipmentID parameter in view_shipment_details AJAX handler", "mode": "block", "severity": 9.1, "slug": "wpcargo", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<8.0.4"}, "RULE-CVE-2026-12720-01": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"name": "ARGS:endpoint", "type": "equals", "value": "update-form-cell"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-12720", "description": "Kirki <=6.0.12 PHP object injection via CSRF-forged kirki_wp_admin_post_apis update-form-cell write (no nonce check) triggering unsafe unserialize on admin review", "mode": "block", "severity": 7.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.12"}, "RULE-CVE-2026-1273-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ultp/v3/starter_dummy_post(/|\\\\?|$)~"}, {"name": "ARGS:api_endpoint", "type": "regex", "value": "~(?:://(?:(?:127(?:[.][0-9]+){0,3}|10(?:[.][0-9]+){1,3}|172[.](?:1[6-9]|2[0-9]|3[01])(?:[.][0-9]+){1,2}|192[.]168(?:[.][0-9]+){1,2}|169[.]254(?:[.][0-9]+){0,2}|0(?:[.]0){1,3}|0x[0-9a-fA-F]+|localhost)(?:[:/?#]|$)|[[]?::1[]]?)|^(?:gopher|file|dict|ftp)://)~i"}], "cve": "CVE-2026-1273", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1273", "description": "PostX <= 5.0.8 SSRF via api_endpoint parameter on /ultp/v3/starter_dummy_post/ REST route", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ultimate-post", "tags": ["ssrf", "server-side-request-forgery", "rest-api"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-1273-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ultp/v3/starter_import_content(/|\\\\?|$)~"}, {"name": "ARGS:api_endpoint", "type": "regex", "value": "~(?:://(?:(?:127(?:[.][0-9]+){0,3}|10(?:[.][0-9]+){1,3}|172[.](?:1[6-9]|2[0-9]|3[01])(?:[.][0-9]+){1,2}|192[.]168(?:[.][0-9]+){1,2}|169[.]254(?:[.][0-9]+){0,2}|0(?:[.]0){1,3}|0x[0-9a-fA-F]+|localhost)(?:[:/?#]|$)|[[]?::1[]]?)|^(?:gopher|file|dict|ftp)://)~i"}], "cve": "CVE-2026-1273", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1273", "description": "PostX <= 5.0.8 SSRF via api_endpoint parameter on /ultp/v3/starter_import_content/ REST route", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ultimate-post", "tags": ["ssrf", "server-side-request-forgery", "rest-api"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-1277-01": {"action": "admin_init", "conditions": [{"name": "ARGS:kc_us_dismiss_promotion", "type": "exists"}, {"name": "ARGS:redirect_to", "type": "regex", "value": "~^(?:https?:)?//(?=\\\\S)|^(?:https?:)?\\\\\\\\\\\\\\\\(?=\\\\S)~i"}], "cve": "CVE-2026-1277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1277", "description": "URL Shortify <=1.12.1 unauthenticated open redirect via redirect_to parameter in promotional dismissal handler", "mode": "block", "severity": 4.7, "slug": "url-shortify", "tags": ["open-redirect", "unauthenticated", "phishing"], "target": "plugin", "versions": "<=1.12.1"}, "RULE-CVE-2026-1279-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[\\\\s*(?:search_employee_directory|employee_form)\\\\b[^\\\\]]*form_title\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[^>]*>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-1279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1279", "description": "Employee Directory <=1.2.1 Stored XSS via search_employee_directory shortcode form_title attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "employee-staff-directory", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-1279-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[\\\\s*(?:search_employee_directory|employee_form)\\\\b[^\\\\]]*form_title\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[^>]*>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-1279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1279", "description": "Employee Directory <=1.2.1 Stored XSS via REST API post content containing malicious shortcode form_title", "method": "POST", "mode": "block", "severity": 6.4, "slug": "employee-staff-directory", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-12793-01": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS:options_page", "type": "exists"}, {"name": "ARGS:meta_fields_map", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-12793", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12793", "description": "JetFormBuilder <=3.6.2 unauthenticated privilege escalation via missing capability check on JetEngine Update Options form action reachable through jet_form_builder_submit", "mode": "block", "severity": 9.8, "slug": "jetformbuilder", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2026-1280-01": {"ajax_action": "wpfm_send_file_in_email", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1280", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1280", "description": "Frontend File Manager Plugin <=23.5 unauthenticated arbitrary file sharing via wpfm_send_file_in_email AJAX action \\u2014 missing nonce and auth checks allow any visitor to email any uploaded file", "method": "POST", "mode": "block", "severity": 7.5, "slug": "nmedia-user-file-uploader", "tags": ["missing-authorization", "idor", "unauthenticated"], "target": "plugin", "versions": "<=23.5"}, "RULE-CVE-2026-12900-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~).)*?(?:]|on(?:error|load|mouseover|click|focus|blur|mouseenter|mousedown)\\\\s*=|javascript\\\\s*:)(?:(?!-->).)*?-->~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-12900", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12900", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.28 contributor+ stored XSS via uagb/image block content", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["stored-xss", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=2.19.28"}, "RULE-CVE-2026-1293-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "yoast-schema"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*/\\\\s*(?i:script)~"}], "cve": "CVE-2026-1293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1293", "description": "Yoast SEO <=26.8 Authenticated (Contributor+) Stored XSS via yoast-schema block attribute in REST API post creation/update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wordpress-seo", "tags": ["xss", "stored-xss", "rest-api", "gutenberg-block"], "target": "plugin", "versions": "<=26.8"}, "RULE-CVE-2026-1293-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "yoast-schema"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*/\\\\s*(?i:script)~"}], "cve": "CVE-2026-1293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1293", "description": "Yoast SEO <=26.8 Authenticated (Contributor+) Stored XSS via yoast-schema block attribute in admin post form submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wordpress-seo", "tags": ["xss", "stored-xss", "admin-post-form", "gutenberg-block"], "target": "plugin", "versions": "<=26.8"}, "RULE-CVE-2026-12937-01": {"ajax_action": "tf_room_availability", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:^|\\\\s)\'|[\'\\"]\\\\s*(?:OR|AND|UNION)\\\\s)~i"}], "cve": "CVE-2026-12937", "description": "Tourfic <=2.22.7 unauthenticated SQL injection via post_id in tf_room_availability AJAX handler", "mode": "block", "severity": 7.5, "slug": "tourfic", "target": "plugin", "versions": "<=2.22.7"}, "RULE-CVE-2026-1294-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=/?)bpivb/v1/image-proxy(?:/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1294", "method": "GET", "mode": "block", "severity": 7.2, "slug": "image-viewer", "target": "plugin", "versions": ">=1.0.0 <=1.0.2"}, "RULE-CVE-2026-1295-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[buynowplus\\\\b[^\\\\]]*(?:]+onerror)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-1295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1295", "description": "Buy Now Plus <=1.0.2 Stored XSS via buynowplus shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "buy-now-plus", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1298-01": {"ajax_action": "eri_from_url", "conditions": [{"name": "ARGS:old_image_id", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1298", "description": "Easy Replace Image <=3.5.2 missing authorization on eri_from_url AJAX handler allows Contributor+ arbitrary attachment replacement", "method": "POST", "mode": "block", "severity": 5.3, "slug": "easy-replace-image", "tags": ["missing-authorization", "broken-access-control", "arbitrary-file-replacement"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2026-1298-02": {"ajax_action": "eri_from_upload", "conditions": [{"name": "ARGS:old_image_id", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1298", "description": "Easy Replace Image <=3.5.2 missing authorization on eri_from_upload AJAX handler allows Contributor+ arbitrary attachment replacement", "method": "POST", "mode": "block", "severity": 5.3, "slug": "easy-replace-image", "tags": ["missing-authorization", "broken-access-control", "arbitrary-file-replacement"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2026-1300-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|]|]|]|]|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1302", "description": "Meta-box GalleryMeta <=3.0.1 Stored XSS via attachment caption (post_excerpt) on editattachment save", "method": "POST", "mode": "block", "severity": 4.4, "slug": "meta-box-gallerymeta", "tags": ["xss", "stored-xss", "output-escaping"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1302-02": {"ajax_action": "save-attachment-compat", "conditions": [{"name": "ARGS:post_excerpt", "type": "regex", "value": "~(?:]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|]|]|]|]|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1302", "description": "Meta-box GalleryMeta <=3.0.1 Stored XSS via attachment caption (post_excerpt) on AJAX save-attachment-compat", "method": "POST", "mode": "block", "severity": 4.4, "slug": "meta-box-gallerymeta", "tags": ["xss", "stored-xss", "output-escaping"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1302-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media/\\\\d+~"}, {"name": "ARGS:caption", "type": "regex", "value": "~(?:]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|]|]|]|]|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1302", "description": "Meta-box GalleryMeta <=3.0.1 Stored XSS via attachment caption (post_excerpt) on REST media update", "method": "POST", "mode": "block", "severity": 4.4, "slug": "meta-box-gallerymeta", "tags": ["xss", "stored-xss", "output-escaping", "rest-api"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1303-01": {"ajax_action": "mailchimp_campaigns_manager_disconnect_app", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1303", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1303", "description": "MailChimp Campaigns <=3.2.4 missing authorization on disconnect_app AJAX action allows Subscriber+ to disconnect Mailchimp integration", "mode": "block", "severity": 5.3, "slug": "olalaweb-mailchimp-campaign-manager", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2026-1307-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/forms/[0-9]+/submissions(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1307", "description": "Ninja Forms <=3.14.1 sensitive information disclosure via REST submissions endpoint accessible to Contributor+", "mode": "block", "severity": 6.5, "slug": "ninja-forms", "tags": ["information-disclosure", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2026-1310-01": {"ajax_action": "miga_editor_cal_delete", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1310", "description": "Simple Calendar for Elementor <=1.6.6 missing authorization on miga_editor_cal_delete AJAX action allows unauthenticated calendar entry deletion", "method": "POST", "mode": "block", "severity": 5.3, "slug": "simple-calendar-for-elementor", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2026-1310-02": {"ajax_action": "miga_editor_cal_update", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1310", "description": "Simple Calendar for Elementor <=1.6.6 missing authorization on miga_editor_cal_update AJAX action allows unauthenticated calendar entry modification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "simple-calendar-for-elementor", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2026-1311-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "worrprba_ajax_upload_backup_file"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1311", "description": "Worry Proof Backup <=0.2.4 authenticated (Subscriber+) path traversal via backup ZIP upload leading to arbitrary file write and RCE", "method": "POST", "mode": "block", "severity": 8.8, "slug": "worry-proof-backup", "tags": ["path-traversal", "arbitrary-file-write", "missing-authorization", "remote-code-execution"], "target": "plugin", "versions": "<=0.2.4"}, "RULE-CVE-2026-1311-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/worrprba/v1/upload-chunk(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1311", "description": "Worry Proof Backup <=0.2.4 REST API upload-chunk endpoint path traversal via unsanitized chunk file upload", "method": "POST", "mode": "block", "severity": 8.8, "slug": "worry-proof-backup", "tags": ["path-traversal", "arbitrary-file-write", "rest-api"], "target": "plugin", "versions": "<=0.2.4"}, "RULE-CVE-2026-1314-01": {"ajax_action": "fb3d_send_post_pages", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1314", "description": "Interactive 3D FlipBook <=1.16.17 missing authorization on fb3d_send_post_pages AJAX action allows unauthenticated post page metadata disclosure", "mode": "block", "severity": 5.3, "slug": "interactive-3d-flipbook-powered-physics-engine", "target": "plugin", "versions": "<=1.16.17"}, "RULE-CVE-2026-13147-01": {"ajax_action": "kirki_get_apis", "conditions": [{"name": "ARGS:endpoint", "type": "equals", "value": "get-pre-built-html"}, {"name": "ARGS:elementUrl", "type": "regex", "value": "~^(?:(?!https?://)[a-zA-Z][a-zA-Z0-9_+.-]*:)|^https?://(?:localhost|127(?:\\\\.[0-9]{1,3}){3}|0\\\\.0\\\\.0\\\\.0|10(?:\\\\.[0-9]{1,3}){3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])(?:\\\\.[0-9]{1,3}){2}|192\\\\.168(?:\\\\.[0-9]{1,3}){2}|169\\\\.254(?:\\\\.[0-9]{1,3}){2}|\\\\[::1\\\\]|\\\\[fe80|\\\\[fc|\\\\[fd)~i"}], "cve": "CVE-2026-13147", "description": "Kirki <6.0.12 unauthenticated SSRF via elementUrl parameter in kirki_get_apis get-pre-built-html endpoint", "mode": "block", "severity": 9.1, "slug": "kirki", "target": "plugin", "versions": "<6.0.12"}, "RULE-CVE-2026-1316-01": {"ajax_action": "cr_upload_media", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1316", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1316", "description": "Customer Reviews for WooCommerce <=5.97.0 unauthenticated stored XSS via media[].href in cr_upload_media AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.97.0"}, "RULE-CVE-2026-1316-02": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1316", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1316", "description": "Customer Reviews for WooCommerce <=5.97.0 unauthenticated stored XSS via media[].href in cr_submit_review AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.97.0"}, "RULE-CVE-2026-1319-01": {"ajax_action": "wio_ng_reoptimize_image", "conditions": [{"name": "ARGS:id", "type": "detectXSS"}], "cve": "CVE-2026-1319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1319", "description": "Robin Image Optimizer <=2.0.2 reflected XSS via id parameter in wio_ng_reoptimize_image AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "robin-image-optimizer", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-1319-02": {"ajax_action": "wio_ng_restore_image", "conditions": [{"name": "ARGS:id", "type": "detectXSS"}], "cve": "CVE-2026-1319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1319", "description": "Robin Image Optimizer <=2.0.2 reflected XSS via id parameter in wio_ng_restore_image AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "robin-image-optimizer", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-1320-01": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:X-Forwarded-For", "type": "detectXSS"}], "config": {}, "cve": "CVE-2026-1320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1320", "description": "Secure Copy Content Protection <= 4.9.8 stored XSS via X-Forwarded-For header in IP logging", "mode": "block", "severity": 7.2, "slug": "secure-copy-content-protection", "tags": ["xss", "stored", "header-injection"], "target": "plugin", "versions": "<4.9.9"}, "RULE-CVE-2026-1321-01": {"ajax_action": "rcp_process_register_form", "conditions": [{"name": "ARGS:rcp_level", "type": "exists"}, {"name": "ARGS:rcp_gateway", "type": "equals", "value": "free"}], "cve": "CVE-2026-1321", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1321", "description": "Membership Plugin \\u2013 Restrict Content <=3.2.20 unauthenticated privilege escalation via rcp_level parameter in AJAX registration", "method": "POST", "mode": "block", "severity": 8.1, "slug": "restrict-content", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-13246-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~givewp_campaign_comments[^\\\\]]*block_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\'\\\\s*(?:on[a-z]+=|style\\\\s*=)|[\'\\"]\\\\s*>\\\\s*<)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-13246", "description": "GiveWP <=4.16.0 authenticated (author+) stored XSS via block_id attribute of givewp_campaign_comments shortcode in post content (Classic editor)", "mode": "block", "severity": 6.4, "slug": "give", "target": "plugin", "versions": "<=4.16.0"}, "RULE-CVE-2026-13246-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~givewp_campaign_comments[^\\\\]]*block_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\'\\\\s*(?:on[a-z]+=|style\\\\s*=)|[\'\\"]\\\\s*>\\\\s*<)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-13246", "description": "GiveWP <=4.16.0 authenticated (author+) stored XSS via block_id attribute of givewp_campaign_comments shortcode in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "give", "target": "plugin", "versions": "<=4.16.0"}, "RULE-CVE-2026-13352-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/async-upload\\\\.php~i"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.(?:exe|apk|msi)[\\\\s.]*$~i"}], "cve": "CVE-2026-13352", "description": "ProfilePress (wp-user-avatar) <=4.16.18 authenticated arbitrary executable file upload via unconditionally widened upload_mimes MIME allowlist (exe/apk/msi) affecting WordPress core media upload (async-upload.php)", "mode": "block", "severity": 8.8, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.16.18"}, "RULE-CVE-2026-1336-01": {"ajax_action": "ays_chatgpt_admin_ajax", "conditions": [{"name": "ARGS:ays_chatgpt_assistant_api_key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1336", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1336", "description": "AI ChatBot with ChatGPT and Content Generator by AYS <=2.7.5 unauthenticated API key modification via ays_chatgpt_admin_ajax AJAX handler", "mode": "block", "severity": 5.3, "slug": "ays-chatgpt-assistant", "tags": ["missing-authorization", "unauthenticated", "settings-modification"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2026-13392-01": {"action": "admin_init", "conditions": [{"name": "ARGS:settings[menu_id]", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-13392", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-13392", "description": "ElementsKit Elementor Addons <3.10.01 multisite subsite administrator privilege escalation via megamenu item settings save missing unfiltered_html/super-admin gate", "mode": "block", "severity": 7.2, "slug": "elementskit-lite", "tags": ["privilege-escalation", "missing-authorization", "multisite", "remote-code-execution"], "target": "plugin", "versions": "<3.10.01"}, "RULE-CVE-2026-13399-01": {"ajax_action": "wc_ppcp_admin_request", "conditions": [{"name": "ARGS:path", "type": "exists"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-13399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-13399", "description": "Payment Plugins for PayPal WooCommerce <2.0.20 missing authorization on wc_ppcp_admin_request AJAX handler allows any authenticated user to forward arbitrary internal REST route paths via the path parameter", "mode": "block", "severity": 7.5, "slug": "pymntpl-paypal-woocommerce", "tags": ["missing-authorization", "authenticated", "privilege-escalation"], "target": "plugin", "versions": "<2.0.20"}, "RULE-CVE-2026-13415-01": {"ajax_action": "cmp_ajax_import_settings", "conditions": [{"name": "ARGS:json", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-13415", "description": "CMP Coming Soon & Maintenance <4.1.18 Editor-role arbitrary WordPress option update via cmp_ajax_import_settings settings-import AJAX action, leading to privilege escalation to Administrator", "mode": "block", "severity": 7.2, "slug": "cmp-coming-soon-maintenance", "target": "plugin", "versions": "<4.1.18"}, "RULE-CVE-2026-13424-01": {"ajax_action": "bookly_speed_up_update_addons", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|]|]|]+onerror)~i"}], "cve": "CVE-2026-13424", "description": "Bookly <=27.7 unauthenticated stored XSS via bookly_speed_up_update_addons AJAX action logged to Diagnostics Logs", "mode": "block", "severity": 7.2, "slug": "bookly-responsive-appointment-booking-tool", "target": "plugin", "versions": "<=27.7"}, "RULE-CVE-2026-13456-01": {"ajax_action": "fc_communication", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-13456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-13456", "description": "WP Maps - Google Maps, OpenStreetMap, Mapbox, Store Locator, Listing, Directory & Filters (wp-google-map-plugin) <=4.9.8 missing authorization on fc_communication AJAX handler in core/class.initiate-core.php, sharing the file with the LFI include() sink", "mode": "block", "severity": 7.5, "slug": "wp-google-map-plugin", "tags": ["missing-authorization", "local-file-inclusion", "authenticated"], "target": "plugin", "versions": "<=4.9.8"}, "RULE-CVE-2026-13596-01": {"ajax_action": "pdb_list_filter", "conditions": [{"name": "ARGS:/search_field|id|pid|private_id/", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*][^*]*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"0-9])~i"}], "cve": "CVE-2026-13596", "description": "Participants Database <2.7.8.4 unauthenticated SQL injection via pdb_list_filter AJAX list/search filter parameters", "mode": "block", "slug": "participants-database", "target": "plugin", "versions": "<2.7.8.4"}, "RULE-CVE-2026-1360-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/xprofile/[0-9]+/data/[0-9]+~i"}, {"name": "ARGS:value", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-1360", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1360", "description": "BuddyPress <=14.5.0 authenticated (subscriber+) PHP object injection via unserialize() without allowed_classes in bp_unserialize_profile_field() through XProfile REST data write endpoint", "mode": "block", "severity": 7.5, "slug": "buddypress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=14.5.0"}, "RULE-CVE-2026-1368-01": {"ajax_action": "get_auth", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1368", "description": "Video Conferencing with Zoom API <4.6.6 unauthenticated Zoom SDK key disclosure via get_auth AJAX handler", "mode": "block", "severity": 7.5, "slug": "video-conferencing-with-zoom-api", "tags": ["improper-authentication", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<4.6.6"}, "RULE-CVE-2026-1369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:redirect_to", "type": "regex", "value": "~^(?:[a-z][a-z0-9+.-]*:|//|\\\\\\\\\\\\\\\\)~i"}], "cve": "CVE-2026-1369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1369", "description": "WP Conditional Captcha <=4.0.0 unauthenticated open redirect via redirect_to in comment submission flow", "mode": "block", "severity": 4.3, "slug": "wp-conditional-captcha", "tags": ["open-redirect", "unauthenticated", "comment-form"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-13704-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:sequoia[introduction][image]", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur|input|change|submit)\\\\s*=|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*(?:text/html|application/javascript)|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-13704", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-13704", "description": "GiveWP <=4.16.1 authenticated (Give Worker+) stored XSS via sequoia[introduction][image] parameter in Sequoia donation form metabox save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "give", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.16.1"}, "RULE-CVE-2026-1373-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/profile.php"}, {"name": "ARGS:author_profile_picture_url", "type": "regex", "value": "~(?:<\\\\s*script|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1373", "description": "Easy Author Image <=1.7 Stored XSS via author_profile_picture_url on profile self-update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-author-image", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2026-1373-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/user-edit.php"}, {"name": "ARGS:author_profile_picture_url", "type": "regex", "value": "~(?:<\\\\s*script|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1373", "description": "Easy Author Image <=1.7 Stored XSS via author_profile_picture_url on admin user-edit", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-author-image", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2026-1375-01": {"ajax_action": "tutor_course_list_bulk_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1375", "description": "Tutor LMS <=3.9.5 IDOR in course bulk action allows instructors to modify/delete arbitrary courses via tutor_course_list_bulk_action", "method": "POST", "mode": "block", "severity": 8.1, "slug": "tutor", "tags": ["idor", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.9.5"}, "RULE-CVE-2026-1375-03": {"ajax_action": "tutor_course_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1375", "description": "Tutor LMS <=3.9.5 IDOR in course deletion allows instructors to delete arbitrary courses via tutor_course_delete", "method": "POST", "mode": "block", "severity": 8.1, "slug": "tutor", "tags": ["idor", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.9.5"}, "RULE-CVE-2026-1391-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vzaar-media-management"}, {"name": "ARGS:bulkcheck", "type": "detectXSS"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via bulkcheck parameter on admin upload page", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1391-02": {"action": "admin_init", "conditions": [{"name": "ARGS:type", "type": "equals", "value": "vzaarmedia"}, {"name": "ARGS:guid", "type": "detectXSS"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via guid parameter on media upload tab", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1391-03": {"action": "admin_init", "conditions": [{"name": "ARGS:type", "type": "equals", "value": "vzaarmedia"}, {"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via post_id parameter on media upload tab", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1391-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vzaar-media-management"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:%3[Cc]|<)[a-zA-Z/!]~"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via PHP_SELF path injection on admin upload page", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1394-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-quick-contact-us"}, {"name": "ARGS:wpQcEmail", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|on[a-zA-Z]{3,}[^=]*=~i"}], "cve": "CVE-2026-1394", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1394", "description": "WP Quick Contact Us <=1.0 CSRF to stored XSS via settings update - wpQcEmail parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-quick-contact-us", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1394-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-quick-contact-us"}, {"name": "ARGS:wpQcSubject", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|on[a-zA-Z]{3,}[^=]*=~i"}], "cve": "CVE-2026-1394", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1394", "description": "WP Quick Contact Us <=1.0 CSRF to stored XSS via settings update - wpQcSubject parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-quick-contact-us", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1394-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-quick-contact-us"}, {"name": "ARGS:wpQcSuccessMsg", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|on[a-zA-Z]{3,}[^=]*=~i"}], "cve": "CVE-2026-1394", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1394", "description": "WP Quick Contact Us <=1.0 CSRF to stored XSS via settings update - wpQcSuccessMsg parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-quick-contact-us", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1400-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/helpers/update_media_metadata(?:/|\\\\?|&|$)~"}, {"name": "ARGS:filename", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-1400", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1400", "description": "AI Engine <=3.3.2 authenticated (Editor+) arbitrary file upload via filename parameter in update_media_metadata REST endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "tags": ["arbitrary-file-upload", "file-rename", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-1401-01": {"action": "admin_post_tune_lib_admin", "conditions": [{"name": "ARGS:importcsv", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1401", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1401", "description": "Tune Library <=1.6.3 missing authorization on CSV import allows authenticated (Subscriber+) stored XSS via admin_post_tune_lib_admin", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tune-library", "tags": ["missing-authorization", "stored-xss", "csv-import", "authenticated"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2026-1401-02": {"action": "admin_post_tune_lib_admin", "conditions": [{"name": "ARGS:importitunes", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1401", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1401", "description": "Tune Library <=1.6.3 missing authorization on iTunes import allows authenticated (Subscriber+) stored XSS via admin_post_tune_lib_admin", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tune-library", "tags": ["missing-authorization", "stored-xss", "itunes-import", "authenticated"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2026-1404-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX search parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-1404-02": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:sorting", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX sorting parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-1404-03": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:filter_tag", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX filter_tag parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-1404-04": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:directory_id", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX directory_id parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-14182-01": {"ajax_action": "verify_otp", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~^otp\\\\[~i"}], "cve": "CVE-2026-14182", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14182", "description": "Customer Email Verification for WooCommerce <3.2.6 unauthenticated account takeover via array-type otp submission to verify_otp (PHP loose-comparison type juggling)", "mode": "block", "severity": 9.8, "slug": "customer-email-verification-for-woocommerce", "tags": ["authentication-bypass", "type-juggling", "account-takeover", "unauthenticated"], "target": "plugin", "versions": "<3.2.6"}, "RULE-CVE-2026-14182-02": {"ajax_action": "verify_otp", "conditions": [{"name": "ARGS:otp", "type": "regex", "value": "~^(?![0-9]+$).*$~"}], "cve": "CVE-2026-14182", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14182", "description": "Customer Email Verification for WooCommerce <3.2.6 unauthenticated account takeover via non-numeric otp value to verify_otp (PHP loose-comparison type juggling)", "mode": "block", "severity": 9.8, "slug": "customer-email-verification-for-woocommerce", "tags": ["authentication-bypass", "type-juggling", "account-takeover", "unauthenticated"], "target": "plugin", "versions": "<3.2.6"}, "RULE-CVE-2026-14182-03": {"ajax_action": "cev_verify_user_email_with_pin", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~^cev_pin1\\\\[~i"}], "cve": "CVE-2026-14182", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14182", "description": "Customer Email Verification for WooCommerce <3.2.6 unauthenticated account takeover via array-type cev_pin1 submission to cev_verify_user_email_with_pin (PHP loose-comparison type juggling)", "mode": "block", "severity": 9.8, "slug": "customer-email-verification-for-woocommerce", "tags": ["authentication-bypass", "type-juggling", "account-takeover", "unauthenticated"], "target": "plugin", "versions": "<3.2.6"}, "RULE-CVE-2026-14182-04": {"ajax_action": "cev_verify_user_email_with_pin", "conditions": [{"name": "ARGS:cev_pin1", "type": "regex", "value": "~^(?![0-9]+$).*$~"}], "cve": "CVE-2026-14182", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14182", "description": "Customer Email Verification for WooCommerce <3.2.6 unauthenticated account takeover via non-numeric cev_pin1 value to cev_verify_user_email_with_pin (PHP loose-comparison type juggling)", "mode": "block", "severity": 9.8, "slug": "customer-email-verification-for-woocommerce", "tags": ["authentication-bypass", "type-juggling", "account-takeover", "unauthenticated"], "target": "plugin", "versions": "<3.2.6"}, "RULE-CVE-2026-1431-01": {"ajax_action": "WPBC_FLEXTIMELINE_NAV", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1431", "description": "Booking Calendar <=10.14.13 unauthenticated booking data exposure via WPBC_FLEXTIMELINE_NAV AJAX action", "mode": "block", "severity": 5.3, "slug": "booking", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=10.14.13"}, "RULE-CVE-2026-14483-01": {"action": "init", "conditions": [{"name": "ARGS:wplformat", "type": "equals", "value": "io"}, {"name": "ARGS:wplview", "type": "equals", "value": "io"}, {"name": "FILES:files:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-14483", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14483", "description": "Real Estate Listing Realtyna WPL <=5.2.0 unauthenticated arbitrary file upload via public I/O service dispatcher (wplformat=io/wplview=io) file upload", "mode": "block", "severity": 9.8, "slug": "real-estate-listing-realtyna-wpl", "tags": ["unrestricted-file-upload", "unauthenticated", "remote-code-execution", "static-credentials"], "target": "plugin", "versions": "<=5.2.0"}, "RULE-CVE-2026-1454-01": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[a-zA-Z][^>]{0,512}on[a-zA-Z]{3,30}[ \\\\t\\\\r\\\\n]*=~i"}], "cve": "CVE-2026-1454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1454", "description": "Lead Form Builder <=2.0.1 unauthenticated stored XSS via form submission - event handler injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "lead-form-builder", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-1454-02": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[ \\\\t\\\\r\\\\n]*script(?:[ \\\\t\\\\r\\\\n]|>|/|$)~i"}], "cve": "CVE-2026-1454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1454", "description": "Lead Form Builder <=2.0.1 unauthenticated stored XSS via form submission - script tag injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "lead-form-builder", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-1454-03": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~javascript(?:[ \\\\t\\\\r\\\\n]|%0[aAdD]|%09|�*9;|�*10;|�*13;| | )*:~i"}], "cve": "CVE-2026-1454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1454", "description": "Lead Form Builder <=2.0.1 unauthenticated stored XSS via form submission - javascript URI injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "lead-form-builder", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-1455-01": {"ajax_action": "wsnfw_save_users_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_users_settings", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-02": {"ajax_action": "wsnfw_save_credentials", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_credentials", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-03": {"ajax_action": "wsnfw_save_wc_sms_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_wc_sms_data", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-04": {"ajax_action": "wsnfw_save_users_sms_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_users_sms_data", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-05": {"ajax_action": "wsnfw_save_gf_sms_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_gf_sms_data", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1461-01": {"action": "wp_loaded", "conditions": [{"name": "ARGS:swpm_process_stripe_subscription", "type": "equals", "value": "1"}, {"name": "ARGS:hook", "type": "equals", "value": "1"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1461", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1461", "description": "Simple Membership <=4.7.0 unauthenticated Stripe webhook signature bypass via missing signing secret validation", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-membership", "tags": ["signature-bypass", "unauthenticated", "webhook-forge", "improper-handling-missing-values"], "target": "plugin", "versions": "<=4.7.0"}, "RULE-CVE-2026-14817-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~data-(?:bdt-[a-zA-Z0-9_-]+|attrs)\\\\s*=\\\\s*(?:\\"|"|\')[^\\"\'>]*?\\\\b(?:template|on[a-zA-Z]{2,20})\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-14817", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14817", "description": "Element Pack Addons for Elementor <8.7.13 contributor+ stored XSS via unsanitized data-bdt-*/data-attrs UIkit attributes in post content", "mode": "block", "severity": 6.8, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "authenticated", "contributor"], "target": "plugin", "versions": "<8.7.13"}, "RULE-CVE-2026-1492-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "user_registration_user_form_submit"}, {"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}], "cve": "CVE-2026-1492", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1492", "description": "User Registration & Membership <=5.1.2 unauthenticated privilege escalation via role parameter in user_registration_user_form_submit AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "user-registration", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-1492-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^user_registration_membership_.+$~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}], "cve": "CVE-2026-1492", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1492", "description": "User Registration & Membership <=5.1.2 unauthenticated privilege escalation via role parameter in membership registration AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "user-registration", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-1492-03": {"action": "init", "conditions": [{"name": "ARGS:ur_frontend_form_id", "type": "exists"}, {"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}], "cve": "CVE-2026-1492", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1492", "description": "User Registration & Membership <=5.1.2 unauthenticated privilege escalation via role parameter in frontend form submission", "method": "POST", "mode": "block", "severity": 9.8, "slug": "user-registration", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-1499-01": {"ajax_action": "process_add_site", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1499", "method": "POST", "mode": "block", "severity": 9.8, "slug": "local-sync", "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2026-15005-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~i"}, {"name": "ARGS:page", "type": "regex", "value": "~^loco~i"}, {"name": "ARGS:template", "type": "regex", "value": "~(?:^(?:php|phar|data|expect|zip|glob|ftps?|https?|compress\\\\.(?:zlib|bzip2)|ssh2|ogg|rar|zlib)://|(?:\\\\.\\\\.[\\\\\\\\/]){2,})~i"}], "cve": "CVE-2026-15005", "description": "Loco Translate <=2.8.5 CSRF-driven local file inclusion via php stream-wrapper URI in template parameter reaching execTemplate include sink", "mode": "block", "severity": 8.8, "slug": "loco-translate", "target": "plugin", "versions": "<=2.8.5"}, "RULE-CVE-2026-15038-01": {"action": "setup_theme", "conditions": [{"name": "ARGS:iwp_action", "type": "equals", "value": "add_site"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-15038", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15038", "description": "InfiniteWP Client <1.13.6 unauthenticated site-connection key bind bypass via empty activation_key on add_site", "mode": "block", "severity": 9.8, "slug": "iwp-client", "tags": ["authentication-bypass", "missing-authorization", "unauthenticated", "multisite"], "target": "plugin", "versions": "<1.13.6"}, "RULE-CVE-2026-15038-02": {"action": "setup_theme", "conditions": [{"name": "ARGS:iwp_action", "type": "equals", "value": "readd_site"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-15038", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15038", "description": "InfiniteWP Client <1.13.6 unauthenticated site-connection key bind bypass via empty activation_key on readd_site", "mode": "block", "severity": 9.8, "slug": "iwp-client", "tags": ["authentication-bypass", "missing-authorization", "unauthenticated", "multisite"], "target": "plugin", "versions": "<1.13.6"}, "RULE-CVE-2026-15096-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_save_data"}, {"name": "ARGS:b_width_map", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 contributor+ stored XSS via b_width_map field in tb_save_data builder save handler (flat param)", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_save_data"}, {"name": "ARGS:data", "type": "regex", "value": "~b_width_map[\\\\s\\\\S]{0,300}?(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 contributor+ stored XSS via b_width_map field nested in tb_save_data JSON data payload", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element"}, {"name": "ARGS:b_width_map", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field in tb_render_element live builder render handler (flat param)", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element"}, {"name": "ARGS:data", "type": "regex", "value": "~b_width_map[\\\\s\\\\S]{0,300}?(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field nested in tb_render_element JSON module payload", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element_shortcode"}, {"name": "ARGS:b_width_map", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field in tb_render_element_shortcode render handler (flat param, sibling of tb_render_element)", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element_shortcode"}, {"name": "ARGS:data", "type": "regex", "value": "~b_width_map[\\\\s\\\\S]{0,300}?(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field nested in tb_render_element_shortcode JSON module payload", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15145-01": {"action": "init", "conditions": [{"name": "ARGS:fancy-text-transition-type", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-15145", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15145", "description": "Essential Addons for Elementor Lite <=6.6.11 stored XSS via Fancy Text widget transition-type value rendered client-side without sanitization", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=6.6.11"}, "RULE-CVE-2026-15244-01": {"ajax_action": "woof_save_options", "conditions": [{"name": "ARGS:formdata", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|zip|phar|expect|glob)://~i"}], "cve": "CVE-2026-15244", "description": "HUSKY WooCommerce Products Filter <1.4.1 shop-manager stored path traversal via search_view leading to local file inclusion", "mode": "block", "slug": "woocommerce-products-filter", "target": "plugin", "versions": "<1.4.1"}, "RULE-CVE-2026-15359-01": {"action": "init", "conditions": [{"name": "ARGS:templately_google_login", "type": "exists"}, {"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2026-15359", "description": "Templately <3.7.1 unauthenticated overwrite of administrator cloud connection via unauthenticated google_login_handler init-hook callback", "mode": "block", "severity": 6.5, "slug": "templately", "target": "plugin", "versions": "<3.7.1"}, "RULE-CVE-2026-15361-01": {"ajax_action": "contentviews_elementor_search_post", "conditions": [{"name": "ARGS:/post_type|term/", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+\\\\b|/\\\\*.*?\\\\*/|--\\\\s)~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-15361", "description": "Content Views <=4.4 authenticated SQL injection via post_type/term in contentviews_elementor_search_post AJAX action", "mode": "block", "slug": "content-views-query-and-display-post-page", "target": "plugin", "versions": "<=4.4"}, "RULE-CVE-2026-15361-02": {"ajax_action": "contentviews_elementor_get_title", "conditions": [{"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-15361", "description": "Content Views <=4.4 missing authorization on contentviews_elementor_get_title AJAX action allows subscriber-level lookup abuse", "mode": "block", "slug": "content-views-query-and-display-post-page", "target": "plugin", "versions": "<=4.4"}, "RULE-CVE-2026-1537-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "steps__load_step"}, {"name": "ARGS:booking[id]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1537", "description": "LatePoint <=5.2.6 IDOR in load_step \\u2014 unauthenticated booking data disclosure via booking[id] in public wizard AJAX", "method": "POST", "mode": "block", "severity": 5.3, "slug": "latepoint", "tags": ["missing-authorization", "information-disclosure", "idor", "unauthenticated"], "target": "plugin", "versions": "<=5.2.6"}, "RULE-CVE-2026-1537-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "latepoint_route_call"}, {"name": "ARGS:route_name", "type": "equals", "value": "steps__load_step"}, {"name": "ARGS:booking[id]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1537", "description": "LatePoint <=5.2.6 IDOR in load_step \\u2014 unauthenticated booking data disclosure via booking[id] in admin_post handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "latepoint", "tags": ["missing-authorization", "information-disclosure", "idor", "unauthenticated"], "target": "plugin", "versions": "<=5.2.6"}, "RULE-CVE-2026-15372-01": {"action": "login_form_validate_2fa", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:wp-auth-id", "type": "exists"}, {"name": "ARGS:wp-auth-nonce", "type": "exists"}, {"name": "ARGS:authcode", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-15372", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15372", "description": "WP 2FA <4.1.0 second-factor authentication bypass at login when the authentication code field is submitted empty during the pending 2FA challenge step", "mode": "block", "severity": 7.5, "slug": "wp-2fa", "tags": ["authentication-bypass", "two-factor-bypass", "unauthenticated"], "target": "plugin", "versions": "<4.1.0"}, "RULE-CVE-2026-1540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "wpcf7"}, {"name": "ARGS:post", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]|]|document\\\\.(?:cookie|write|location)|eval\\\\s*\\\\()~i"}], "cve": "CVE-2026-1540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1540", "description": "Spam Protect for Contact Form 7 <=1.2.9 authenticated (admin+) stored XSS / code injection via unsanitized CF7 form settings", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-contact-form-7-spam-blocker", "tags": ["xss", "stored", "code-injection", "authenticated"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2026-15414-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wps_membership_plan"}, {"name": "ARGS:_wps_plan_user_role", "type": "exists"}, {"name": "missing_capability", "type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-15414", "description": "Subscriptions for WooCommerce <=2.0.0 privilege escalation via _wps_plan_user_role membership plan meta persisted without manage_woocommerce authorization", "mode": "block", "slug": "subscriptions-for-woocommerce", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-1542-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[;&])O:[0-9]+:\\"[A-Za-z_]~"}], "cve": "CVE-2026-1542", "method": "POST", "mode": "block", "severity": 6.5, "slug": "super-stage-wp", "target": "plugin", "versions": "<1.0.2"}, "RULE-CVE-2026-15446-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~]*\\\\bclass\\\\s*=\\\\s*[\\"\'][^\\"\']*\\\\blazyload\\\\b)(?=[^>]*\\\\bdata-script\\\\s*=\\\\s*[\\"\'](?:https?:)?//)[^>]*>~i"}], "cve": "CVE-2026-15446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15446", "description": "EWWW Image Optimizer <=8.7.3 authenticated (contributor+) stored XSS via lazyload data-script attribute in post content", "mode": "block", "severity": 6.4, "slug": "ewww-image-optimizer", "tags": ["stored-xss", "authenticated", "lazy-load-injection"], "target": "plugin", "versions": "<=8.7.3"}, "RULE-CVE-2026-15459-01": {"action": "init", "conditions": [{"name": "ARGS:wpmudev-hub", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-15459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15459", "description": "WPMU DEV Dashboard <= 5.0.0 unauthenticated authentication bypass. The Hub remote handler is bound to the public init hook with no capability check and is gated only by the WDP-AUTH request signature, which validate_hash() verifies with the site API key. On sites not yet connected to the WPMU DEV Hub (the default state after installation) that key is empty, so the signature is trivially forgeable and unauthenticated attackers can invoke privileged Hub actions: installing and activating a plugin from an attacker-supplied URL (RCE), deleting plugins and themes, upgrading core, or logging in as administrator via SSO. The handler returns immediately unless the wpmudev-hub query parameter is present, so that parameter is the mandatory entry point for every exploit attempt.", "mode": "block", "severity": 8.1, "slug": "wpmudev-updates", "tags": ["auth-bypass", "unauthenticated", "rce", "privilege-escalation"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2026-1557-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-responsive-images/image_handler\\\\.php~"}, {"name": "ARGS:src", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/etc/passwd|(?:^|[\\\\\\\\/])(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)$)~i"}], "cve": "CVE-2026-1557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1557", "description": "WP Responsive Images <=1.0 unauthenticated path traversal to arbitrary file read via src parameter in image_handler.php", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wp-responsive-images", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated", "local-file-inclusion"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1560-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lazy-blocks/v1/block-builder-preview(/|\\\\?|&|$)~"}, {"name": "REQUEST_COOKIES:/^wordpress_logged_in_/", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1560", "method": "POST", "mode": "block", "severity": 8.8, "slug": "lazy-blocks", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-1565-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "upload-attachment"}, {"name": "ARGS:type", "type": "equals", "value": "wpuf-form-uploader"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1565", "description": "WP User Frontend <=4.2.8 authenticated (Author+) arbitrary file upload via upload-attachment with wpuf-form-uploader type bypass", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "tags": ["arbitrary-file-upload", "file-upload-extension-bypass", "missing-authorization"], "target": "plugin", "versions": "<=4.2.8"}, "RULE-CVE-2026-1565-02": {"ajax_action": "wpuf_import_forms", "conditions": [{"name": "ARGS:file_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1565", "description": "WP User Frontend <=4.2.8 authenticated (Author+) arbitrary file import via wpuf_import_forms AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "tags": ["arbitrary-file-upload", "missing-authorization"], "target": "plugin", "versions": "<=4.2.8"}, "RULE-CVE-2026-1566-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:customer[wordpress_user_id]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1566", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1566", "description": "LatePoint <=5.2.7 privilege escalation via mass-assignment of customer[wordpress_user_id] through AJAX route dispatcher", "method": "POST", "mode": "block", "severity": 8.8, "slug": "latepoint", "tags": ["privilege-escalation", "improper-privilege-management", "mass-assignment"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2026-1566-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "latepoint_route_call"}, {"name": "ARGS:customer[wordpress_user_id]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1566", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1566", "description": "LatePoint <=5.2.7 privilege escalation via mass-assignment of customer[wordpress_user_id] through admin-post route dispatcher", "method": "POST", "mode": "block", "severity": 8.8, "slug": "latepoint", "tags": ["privilege-escalation", "improper-privilege-management", "mass-assignment"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2026-1569-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wueen-blocket\\\\b[^\\\\]]*err-404\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|\\\\s*<~i"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode title tag injection (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[myqtip[^\\\\]]*\\\\].*\\\\s*<~i"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode title tag injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[myqtip[^\\\\]]*\\\\].* module_object->get_field), so the attacker-controlled filetypes/custom-files injection cannot be reached here", "method": "POST", "mode": "block", "severity": 9.8, "slug": "forminator", "tags": ["file-upload", "arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.56.1"}, "RULE-CVE-2026-15748-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_form_~"}, {"name": "FILES:upload-2:name", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|t|tm|tml|ar|ps?)|htaccess|user\\\\.ini)$~i"}], "cve": "CVE-2026-15748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15748", "description": "Forminator <=1.56.1 unauthenticated arbitrary file upload to RCE via public form submission (server-executable filename on upload-2). Covers this field id only - the engine cannot yet express a scan across every upload field, so an upload sent under any other name is caught by RULE-CVE-2026-15748-05 instead of here", "method": "POST", "mode": "block", "severity": 9.8, "slug": "forminator", "tags": ["file-upload", "arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.56.1"}, "RULE-CVE-2026-15748-04": {"ajax_action": "forminator_multiple_file_upload", "conditions": [{"name": "FILES:upload-2:name", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|t|tm|tml|ar|ps?)|htaccess|user\\\\.ini)$~i"}], "cve": "CVE-2026-15748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15748", "description": "Forminator <=1.56.1 hardening - PHP-executable filename submitted to the forminator_multiple_file_upload AJAX endpoint on upload-2. Defence-in-depth, not the CVE-2026-15748 exploit path. That handler resolves the upload field config from the stored form definition (Forminator_CForm_Front::multiple_file_upload -> module_object->get_field), so the attacker-controlled filetypes/custom-files injection cannot be reached here", "method": "POST", "mode": "block", "severity": 9.8, "slug": "forminator", "tags": ["file-upload", "arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.56.1"}, "RULE-CVE-2026-15748-05": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_(?:preview_)?form_~"}, {"name": "ARGS:/^.+$/[return]", "type": "exists"}, {"name": "ARGS:/^.+$/[field_type]", "type": "equals", "value": "upload"}], "cve": "CVE-2026-15748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15748", "description": "Forminator <=1.56.1 unauthenticated arbitrary file upload to RCE - field_data_array injection via a client-supplied `return` key carrying a forged upload field config (matches the vulnerability primitive, independent of the uploaded file field name)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "forminator", "tags": ["file-upload", "arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.56.1"}, "RULE-CVE-2026-15748-06": {"action": "init", "block_policy": "never_block", "companion_for": "RULE-CVE-2026-15748-05", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_(?:preview_)?form_~"}, {"name": "ARGS:/^.+$/[return]", "type": "exists"}], "cve": "CVE-2026-15748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15748", "description": "Forminator <=1.56.1 companion sampler - any client-supplied `return` key on a public form submission (the sanitize/validate bypass primitive, regardless of injected field type). Pass-only, measures whether RULE-CVE-2026-15748-05 misses real attacks", "method": "POST", "mode": "pass", "severity": 9.8, "slug": "forminator", "tags": ["file-upload", "arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.56.1"}, "RULE-CVE-2026-15797-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "popup"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:<?|�*60;?|�*3c;?)\\\\s*(?:script|iframe|svg|img|body|object|embed|on[a-z]+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-15797", "description": "Popup Maker <=1.24.0 contributor+ stored XSS via HTML entity-encoded payload in post_title on the popup post type", "mode": "block", "slug": "popup-maker", "target": "plugin", "versions": "<=1.24.0"}, "RULE-CVE-2026-15798-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:data-href|data-redirect-url)\\\\s*=\\\\s*[\\"\']\\\\s*(?:javascript|vbscript)\\\\s*(?::|�*58;?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-15798", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15798", "description": "Smart Slider 3 <=3.5.1.38 stored XSS via unsanitized data-href/data-redirect-url slide link attributes for users lacking unfiltered_html", "mode": "block", "severity": 6.4, "slug": "smart-slider-3", "tags": ["xss", "stored-xss", "authenticated", "gutenberg"], "target": "plugin", "versions": "<=3.5.1.38"}, "RULE-CVE-2026-1581-01": {"action": "init", "conditions": [{"name": "ARGS:wpfob", "type": "detectSQLi"}], "cve": "CVE-2026-1581", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpforo", "target": "plugin", "versions": "<=2.4.14"}, "RULE-CVE-2026-15988-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mcp/v1/oauth/authorize[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-15988", "description": "AI Engine <=3.6.5 CSRF-based REST authentication bypass via missing nonce validation on reauth_for_authorize (mcp/v1/oauth/authorize)", "mode": "block", "slug": "ai-engine", "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2026-15988-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mcp/v1/oauth/authorize[\\\\\\\\/]*$~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-15988", "description": "AI Engine <=3.6.5 CSRF-based REST authentication bypass via missing nonce validation on reauth_for_authorize (mcp/v1/oauth/authorize)", "mode": "block", "slug": "ai-engine", "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2026-1608-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]youtube[^]]*(?:on[a-zA-Z]+=|javascript:|]+onerror)~i"}], "cve": "CVE-2026-1608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1608", "description": "Video Onclick <=0.4.7 Stored XSS via youtube shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "video-onclick", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.4.7"}, "RULE-CVE-2026-1608-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]youtube[^]]*(?:on[a-zA-Z]+=|javascript:|]+onerror)~i"}], "cve": "CVE-2026-1608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1608", "description": "Video Onclick <=0.4.7 Stored XSS via youtube shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "video-onclick", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.4.7"}, "RULE-CVE-2026-1611-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wikiloops\\\\b[^\\\\]]*(?:<[^>]+>|\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1611", "description": "Wikiloops Track Player <=1.0.1 Stored XSS via wikiloops shortcode attributes in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wikiloops-track-player", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1611-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wikiloops\\\\b[^\\\\]]*(?:<[^>]+>|\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1611", "description": "Wikiloops Track Player <=1.0.1 Stored XSS via wikiloops shortcode attributes in REST API content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wikiloops-track-player", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1614-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post create", "method": "POST", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1614-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1614-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post update (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1614-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post update (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1620-01": {"ajax_action": "lae_admin_ajax", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.{2,}/+){2,}|(?:php|phar|data|expect|zip|glob)://|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1620", "description": "Livemesh Addons for Elementor <=9.0 authenticated (Contributor+) Local File Inclusion via template parameter in lae_admin_ajax handler", "mode": "block", "severity": 8.8, "slug": "addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=9.0"}, "RULE-CVE-2026-1634-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~subitem-al-slider~"}, {"name": "REQUEST_URI", "type": "detectXSS"}], "cve": "CVE-2026-1634", "method": "GET", "mode": "block", "severity": 6.1, "slug": "subitem-al-slider", "target": "plugin", "versions": "<1.1"}, "RULE-CVE-2026-1639-01": {"ajax_action": "wppm_get_project_list", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2026-1639", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1639", "description": "Taskbuilder <=5.0.2 authenticated (Subscriber+) SQL injection via order parameter in wppm_get_project_list AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "taskbuilder", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-1639-02": {"ajax_action": "wppm_get_project_list", "conditions": [{"name": "ARGS:sort_by", "type": "detectSQLi"}], "cve": "CVE-2026-1639", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1639", "description": "Taskbuilder <=5.0.2 authenticated (Subscriber+) SQL injection via sort_by parameter in wppm_get_project_list AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "taskbuilder", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-1643-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mp-ukagaka"}, {"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php/[^?]*(?:[<>\\"\'=]|%(?:22|27|3[CEce]|3[Dd]))~i"}], "cve": "CVE-2026-1643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1643", "description": "MP-Ukagaka <=1.5.2 Reflected XSS via unsanitized PHP_SELF in admin settings page (GET)", "method": "GET", "mode": "block", "severity": 6.1, "slug": "mp-ukagaka", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2026-1643-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mp-ukagaka"}, {"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php/[^?]*(?:[<>\\"\'=]|%(?:22|27|3[CEce]|3[Dd]))~i"}], "cve": "CVE-2026-1643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1643", "description": "MP-Ukagaka <=1.5.2 Reflected XSS via unsanitized PHP_SELF in admin settings page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "mp-ukagaka", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2026-1644-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:approve|deny|block)$~i"}, {"name": "ARGS:user", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-1644", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1644", "description": "WP Front End Profile <=1.3.8 CSRF on user approval/denial/blocking via update_action on users.php", "mode": "block", "severity": 4.3, "slug": "wp-front-end-profile", "tags": ["csrf", "missing-authorization", "user-management"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2026-1646-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenberg-extend/posts-block\\\\s*\\\\{[^}]*\\"(?:TitleColor|boxColor|TxtFontSize)\\"\\\\s*:\\\\s*\\"(?:[^\\"\\\\\\\\]|\\\\\\\\.)*(?:<[a-z][\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mousedown|keydown|keyup)\\\\s*=|javascript\\\\s*:|)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1646", "description": "Advance Block Extend <=1.0.4 contributor+ stored XSS via TitleColor/boxColor/TxtFontSize block attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advance-block-extend", "tags": ["xss", "stored", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-1646-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~gutenberg-extend/posts-block\\\\s*\\\\{[^}]*\\"(?:TitleColor|boxColor|TxtFontSize)\\"\\\\s*:\\\\s*\\"(?:[^\\"\\\\\\\\]|\\\\\\\\.)*(?:<[a-z][\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mousedown|keydown|keyup)\\\\s*=|javascript\\\\s*:|)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1646", "description": "Advance Block Extend <=1.0.4 contributor+ stored XSS via TitleColor/boxColor/TxtFontSize block attributes in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advance-block-extend", "tags": ["xss", "stored", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-1649-01": {"action": "admin_post_save_community_events_venues", "conditions": [{"name": "ARGS:ce_venue_name", "type": "detectXSS"}], "cve": "CVE-2026-1649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1649", "description": "Community Events <=1.5.7 authenticated stored XSS via ce_venue_name in venue save handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "community-events", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.5.7"}, "RULE-CVE-2026-1650-01": {"action": "admin_init", "conditions": [{"name": "ARGS:delete_custom_field", "type": "exists"}, {"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_mdjm"}], "cve": "CVE-2026-1650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1650", "description": "MDJM Event Management <=1.7.8.1 unauthenticated arbitrary custom field deletion via delete_custom_field parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "mobile-dj-manager", "tags": ["missing-authorization", "unauthenticated", "arbitrary-deletion"], "target": "plugin", "versions": "<=1.7.8.1"}, "RULE-CVE-2026-1650-02": {"action": "admin_init", "conditions": [{"name": "ARGS:submit_custom_field", "type": "exists"}, {"type": "missing_capability", "value": "manage_mdjm"}], "cve": "CVE-2026-1650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1650", "description": "MDJM Event Management <=1.7.8.1 unauthenticated arbitrary custom field creation/update via submit_custom_field parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mobile-dj-manager", "tags": ["missing-authorization", "unauthenticated", "arbitrary-modification"], "target": "plugin", "versions": "<=1.7.8.1"}, "RULE-CVE-2026-16502-01": {"ajax_action": "dslc-ajax-save-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_code in save-composer AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-16502-02": {"ajax_action": "dslc-ajax-save-draft-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_code in save-draft-composer AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-16502-03": {"ajax_action": "dslc-ajax-save-template", "conditions": [{"name": "ARGS:dslc_template_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_template_code in save-template AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-16502-04": {"ajax_action": "dslc-ajax-import-template", "conditions": [{"name": "ARGS:dslc_template_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_template_code in import-template AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-16502-05": {"ajax_action": "dslc-ajax-save-preset", "conditions": [{"name": "ARGS:dslc_preset_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_preset_code in save-preset AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-16502-06": {"ajax_action": "dslc-ajax-import-modules-section", "conditions": [{"name": "ARGS:dslc_modules_section_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_modules_section_code in import-modules-section AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-1651-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:handler", "type": "equals", "value": "workflows"}, {"name": "ARGS:method", "type": "equals", "value": "update_status"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:UNION[ ]+(?:ALL[ ]+)?SELECT|[0-9]+[)]+[ ]*(?:AND|OR|UNION)[ ]|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|IF[ ]*[(].*,.*,|LOAD_FILE|INTO[ ]+(?:OUTFILE|DUMPFILE))~i"}], "cve": "CVE-2026-1651", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1651", "description": "Email Subscribers & Newsletters <=5.9.16 authenticated (Administrator+) SQL injection via workflow_ids in data parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "email-subscribers", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.9.16"}, "RULE-CVE-2026-16534-01": {"ajax_action": "acui_import_users_batch", "conditions": [{"name": "", "type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-16534", "description": "Import and export users and customers <2.4.2 privilege escalation via missing promote_users check on CSV import role assignment (acui_import_users_batch)", "mode": "block", "slug": "import-users-from-csv-with-meta", "target": "plugin", "versions": "<2.4.2"}, "RULE-CVE-2026-16534-02": {"ajax_action": "acui_import_users_batch", "conditions": [{"name": "", "type": "missing_capability", "value": "edit_user"}], "cve": "CVE-2026-16534", "description": "Import and export users and customers <2.4.2 account takeover via missing edit_user check on existing-user password/email overwrite during CSV import (acui_import_users_batch)", "mode": "block", "slug": "import-users-from-csv-with-meta", "target": "plugin", "versions": "<2.4.2"}, "RULE-CVE-2026-1655-01": {"ajax_action": "ep_save_frontend_event_submission", "conditions": [{"name": "ARGS:event_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1655", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1655", "description": "EventPrime <=4.2.8.4 missing authorization on ep_save_frontend_event_submission allows subscriber+ arbitrary event modification via event_id IDOR", "mode": "block", "severity": 4.3, "slug": "eventprime-event-calendar-management", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=4.2.8.4"}, "RULE-CVE-2026-1656-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wpbdp_ajax"}, {"name": "ARGS:listing_id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"name": "ARGS:/listingfields|listing_fields|fields/", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1656", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1656", "description": "Business Directory Plugin <=6.4.20 unauthenticated arbitrary listing modification via wpbdp_ajax AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "business-directory-plugin", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "idor"], "target": "plugin", "versions": "<=6.4.20"}, "RULE-CVE-2026-16562-01": {"ajax_action": "wp_statistics_update_post_type_db", "conditions": [{"name": "ARGS:number_all", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-16562", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16562", "description": "WP Statistics <14.16.10 missing capability check on wp_statistics_update_post_type_db AJAX handler allows subscriber+ unauthorized action trigger", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<14.16.10"}, "RULE-CVE-2026-16576-01": {"action": "admin_init", "conditions": [{"name": "ARGS:plugin_id", "type": "exists"}, {"name": "ARGS:plugin_info", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-16576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16576", "description": "Dokan (dokan-lite) <5.0.14 incorrect capability check allows Shop Manager role to install arbitrary plugins via setup wizard install_plugin flow", "mode": "block", "severity": 7.2, "slug": "dokan-lite", "tags": ["missing-authorization", "privilege-escalation", "plugin-installation", "authenticated"], "target": "plugin", "versions": "<5.0.14"}, "RULE-CVE-2026-16597-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\s*<(?:script\\\\b|[a-zA-Z]+[^>]*\\\\bon[a-zA-Z]+\\\\s*=)~i"}], "cve": "CVE-2026-16597", "description": "GTM4WP <=1.22.3 unauthenticated stored XSS via WooCommerce guest checkout billing field script-tag breakout rendered unescaped in frontend dataLayer JSON", "mode": "block", "severity": 7.2, "slug": "duracelltomi-google-tag-manager", "target": "plugin", "versions": "<=1.22.3"}, "RULE-CVE-2026-1671-01": {"ajax_action": "winter_activity_log_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:page", "type": "regex", "value": "~^(?:wal_favouritelogs|wal_controlsecurity|wal_history|wal_usersessions|wal_reports|wal_logalerts|wal_disabledlogs|wal_cloudintegration|winteractivitylog)$~"}, {"name": "ARGS:function", "type": "regex", "value": "~^(?:datatable|datatable_saved|edit_log|edit_history|control_log|filter_get|filter_save|filter_remove|clear_all_log|bulk_remove)$~"}], "cve": "CVE-2026-1671", "method": "POST", "mode": "block", "severity": 6.5, "slug": "winterlock", "target": "plugin", "versions": "<1.2.9"}, "RULE-CVE-2026-16747-01": {"action": "init", "conditions": [{"name": "ARGS:_kirki_form", "type": "exists"}, {"name": "ARGS:_wpnonce", "type": "exists"}, {"name": "ARGS:/^(replyTo|name|subject|emailList)$/", "type": "regex", "value": "~\\\\[[a-zA-Z][a-zA-Z0-9_-]*(?:\\\\s[^\\\\]]*)?\\\\]~i"}], "cve": "CVE-2026-16747", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16747", "description": "Kirki <6.2.1 unauthenticated shortcode injection via front-end form submission fields leading to admin email disclosure and mail relay", "mode": "block", "severity": 6.5, "slug": "kirki", "tags": ["missing-authorization", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<6.2.1"}, "RULE-CVE-2026-1675-01": {"action": "init", "conditions": [{"name": "ARGS:OpenSesame", "type": "regex", "value": "~^0*1$~"}], "cve": "CVE-2026-1675", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1675", "description": "Advanced Country Blocker <=2.3.1 unauthenticated authorization bypass via insecure default secret key", "mode": "block", "severity": 5.3, "slug": "advanced-country-blocker", "tags": ["authorization-bypass", "insecure-default", "unauthenticated"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-16775-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[custom-facebook-feed\\\\b.{0,200}?(?:]*>|on(?:error|load|click|mouseover|focus|mouseenter|mouseout)\\\\s*=|javascript\\\\s*:|]*onerror)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-16775", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16775", "description": "Custom Facebook Feed <=4.9.0 stored XSS via unescaped \'id\' shortcode attribute injected in post content by contributor-level users", "mode": "block", "severity": 6.4, "slug": "custom-facebook-feed", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.9.0"}, "RULE-CVE-2026-16974-01": {"action": "init", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~&(?:lt;|#0*60;|#x0*3c;)\\\\s*(?:script|img|svg|iframe|body|object|embed)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-16974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16974", "description": "Kirki <=6.2.0 contributor+ stored XSS via HTML-entity-encoded markup in comment field bypassing sanitize_text_field", "mode": "block", "severity": 6.4, "slug": "kirki", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-17037-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "kirki-comment"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:&(?:lt|#0*60|#x0*3c)[;]?\\\\s*(?:script\\\\b|[a-z][a-z0-9]*\\\\b[^&<>]{0,60}\\\\bon[a-zA-Z0-9_]+\\\\s*=)|]|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)~i"}], "cve": "CVE-2026-17037", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17037", "description": "Kirki <=6.2.0 stored XSS via HTML-entity-encoded script/event-handler payload in \'comment\' parameter on kirki-comment REST endpoint", "mode": "block", "severity": 7.2, "slug": "kirki", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-17037-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "kirki-comment"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:&(?:lt|#0*60|#x0*3c)[;]?\\\\s*(?:script\\\\b|[a-z][a-z0-9]*\\\\b[^&<>]{0,60}\\\\bon[a-zA-Z0-9_]+\\\\s*=)|]|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)~i"}], "cve": "CVE-2026-17037", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17037", "description": "Kirki <=6.2.0 stored XSS via HTML-entity-encoded script/event-handler payload in \'name\' parameter on kirki-comment REST endpoint", "mode": "block", "severity": 7.2, "slug": "kirki", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-1706-01": {"action": "init", "conditions": [{"name": "ARGS:vi", "type": "regex", "value": "~(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2026-1706", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1706", "description": "All-in-One Video Gallery <=4.7.1 Reflected XSS via vi parameter in search form templates", "mode": "block", "severity": 6.1, "slug": "all-in-one-video-gallery", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-1708-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/appointments(/|\\\\?|$)~"}, {"name": "ARGS:append_where_sql", "type": "exists"}], "cve": "CVE-2026-1708", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1708", "description": "Simply Schedule Appointments <=1.6.9.27 unauthenticated blind SQL injection via append_where_sql parameter in JSON body on REST /ssa/v1/appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api", "json-body-bypass"], "target": "plugin", "versions": "<=1.6.9.27"}, "RULE-CVE-2026-17086-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-17086", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17086", "description": "ShortPixel Image Optimiser <=6.5.5 PHP object injection via unsafe deserialization in Replacer::replaceContent (unserialize with allowed_classes=true)", "mode": "block", "severity": 8.8, "slug": "shortpixel-image-optimiser", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=6.5.5"}, "RULE-CVE-2026-17090-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:fl_builder_data", "type": "regex", "value": "~(?:\\\\s*<\\\\s*script|<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover)\\\\s*=\\\\s*[\\"\'])~i"}], "cve": "CVE-2026-17090", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17090", "description": "Beaver Builder Page Builder <=2.10.2.2 author+ stored XSS via Button module \'button\' (Button Code) setting due to insufficient output escaping; the exact settings-save AJAX action is unresolved in available artefacts (code_analyst.entrypoints[EP-FLBUILDER-AJAX-UNRESOLVED-SAVE], confidence 0.42, handler:null), so this rule scopes to the admin-ajax.php front controller and the evidenced fl_builder_data payload parameter and targets script/tag-breakout signatures rather than a fabricated action name", "mode": "block", "severity": 6.4, "slug": "beaver-builder-lite-version", "tags": ["stored-xss", "authenticated", "output-escaping"], "target": "plugin", "versions": "<=2.10.2.2"}, "RULE-CVE-2026-1714-01": {"ajax_action": "woolentor_suggest_price_action", "conditions": [{"name": "ARGS:send_to", "type": "regex", "value": "~[,;\\\\s]~"}], "cve": "CVE-2026-1714", "method": "POST", "mode": "block", "severity": 8.6, "slug": "woolentor-addons", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-1714-02": {"ajax_action": "woolentor_suggest_price_action", "conditions": [{"name": "ARGS:wlemail", "type": "regex", "value": "~(%0d|%0a|\\\\r|\\\\n)~i"}], "cve": "CVE-2026-1714", "method": "POST", "mode": "block", "severity": 8.6, "slug": "woolentor-addons", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-1720-01": {"ajax_action": "optn_install", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-1720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1720", "description": "WowOptin <=1.4.24 missing authorization on optn_install AJAX action allows Subscriber+ arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "optin", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=1.4.24"}, "RULE-CVE-2026-1720-02": {"ajax_action": "optn_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-1720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1720", "description": "WowOptin <=1.4.24 missing authorization on optn_install_plugin AJAX action allows Subscriber+ arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "optin", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=1.4.24"}, "RULE-CVE-2026-1750-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~"}, {"name": "ARGS:ec_store_admin_access", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1750", "description": "Ecwid Ecommerce Shopping Cart <=7.0.7 privilege escalation via ec_store_admin_access on profile update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ecwid-shopping-cart", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2026-1750-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/user-edit\\\\.php~"}, {"name": "ARGS:ec_store_admin_access", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1750", "description": "Ecwid Ecommerce Shopping Cart <=7.0.7 privilege escalation via ec_store_admin_access on user edit", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ecwid-shopping-cart", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2026-1750-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:ec_store_admin_access", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1750", "description": "Ecwid Ecommerce Shopping Cart <=7.0.7 privilege escalation via ec_store_admin_access on user registration", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ecwid-shopping-cart", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2026-17505-01": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~#!trp(?:st|en)#~i"}], "cve": "CVE-2026-17505", "description": "TranslatePress <=3.2.5 unauthenticated reflected XSS via marker token smuggling in search parameter s", "mode": "block", "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=3.2.5"}, "RULE-CVE-2026-1754-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "personal-authors-category"}, {"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php(?:%2[fF]|/)[^?]~i"}], "cve": "CVE-2026-1754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1754", "description": "Personal Authors Category <=0.3 reflected XSS via PHP_SELF path injection on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "personal-authors-category", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=0.3"}, "RULE-CVE-2026-17540-01": {"action": "init", "conditions": [{"name": "ARGS:cmd", "type": "regex", "value": "~^(?:file|zipdl|get|put|rm)$~i"}, {"type": "missing_capability", "value": "edit_files"}], "cve": "CVE-2026-17540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17540", "description": "File Manager <6.9.1 authenticated arbitrary file read/delete via unauthorized connector command dispatch", "mode": "block", "severity": 8.8, "slug": "file-manager", "tags": ["missing-authorization", "broken-access-control", "arbitrary-file-read", "arbitrary-file-delete", "authenticated"], "target": "plugin", "versions": "<6.9.1"}, "RULE-CVE-2026-1755-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_wp_attachment_image_alt", "type": "regex", "value": "~(?:<\\\\s*script|on(?:error|load|click|mouseover|focus|blur|input|change|submit|reset|keydown|keyup|keypress|dblclick|mousedown|mouseup|mouseenter|mouseleave|mousemove|mouseout)\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1755", "description": "Menu Icons by ThemeIsle <=0.13.20 Stored XSS via media attachment alt text (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "menu-icons", "tags": ["xss", "stored-xss", "media-upload"], "target": "plugin", "versions": "<=0.13.20"}, "RULE-CVE-2026-1755-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media/\\\\d+~"}, {"name": "ARGS:alt_text", "type": "regex", "value": "~(?:<\\\\s*script|on(?:error|load|click|mouseover|focus|blur|input|change|submit|reset|keydown|keyup|keypress|dblclick|mousedown|mouseup|mouseenter|mouseleave|mousemove|mouseout)\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1755", "description": "Menu Icons by ThemeIsle <=0.13.20 Stored XSS via REST API media alt_text update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "menu-icons", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=0.13.20"}, "RULE-CVE-2026-17576-01": {"action": "init", "conditions": [{"name": "ARGS:iwp_action", "type": "equals", "value": "get_comments"}, {"name": "ARGS_NAMES", "type": "regex", "value": "~iwp_get_comments_[^\']*\'~i"}], "cve": "CVE-2026-17576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17576", "description": "InfiniteWP Client <=1.13.9 SQL injection via array-key names in get_comments signed remote-action JSON body", "mode": "block", "severity": 6.5, "slug": "iwp-client", "tags": ["sql-injection", "authenticated", "administrator-required", "remote-management"], "target": "plugin", "versions": "<=1.13.9"}, "RULE-CVE-2026-1781-01": {"action": "init", "conditions": [{"name": "ARGS:_mc4wp_action", "type": "equals", "value": "unsubscribe"}, {"name": "ARGS:_mc4wp_form_id", "type": "regex", "value": "~^\\\\d+$~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-(admin|json)/|^/wp-login\\\\.php~"}], "cve": "CVE-2026-1781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1781", "description": "MC4WP: Mailchimp for WordPress <=4.11.1 unauthenticated arbitrary email unsubscribe via _mc4wp_action parameter override (partial: admin/API endpoints)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "mailchimp-for-wp", "tags": ["missing-authorization", "unauthenticated", "action-override"], "target": "plugin", "versions": "<=4.11.1"}, "RULE-CVE-2026-1786-01": {"action": "init", "conditions": [{"name": "ARGS:/^dg_tw_options/", "type": "regex", "value": "~\\\\S~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1786", "method": "POST", "mode": "block", "severity": 6.5, "slug": "twitter-posts-to-blog", "target": "plugin", "versions": "<1.11.26"}, "RULE-CVE-2026-1787-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/.*delete-migrated-data/tutor(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1787", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1787", "description": "LearnPress Export Import <=4.1.0 unauthenticated deletion of migrated course data via REST API delete-migrated-data/tutor endpoint", "method": "DELETE", "mode": "block", "severity": 4.8, "slug": "learnpress-import-export", "tags": ["missing-authorization", "unauthenticated", "rest-api", "data-deletion"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2026-1792-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php/[^?]*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "ARGS:page", "type": "equals", "value": "GeoWidget"}], "cve": "CVE-2026-1792", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1792", "description": "GeoWidget <=1.0 reflected XSS via $_SERVER[\'PHP_SELF\'] on admin settings page", "mode": "block", "severity": 6.1, "slug": "geowidget", "tags": ["xss", "reflected", "php-self"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1793-01": {"action": "init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}(?:[\\\\w./\\\\\\\\-]*)?(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2026-1793", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1793", "description": "Element Pack Addons for Elementor <=8.3.17 authenticated arbitrary file read via SVG Image widget path traversal", "method": "POST", "mode": "block", "severity": 6.5, "slug": "bdthemes-element-pack-lite", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=8.3.17"}, "RULE-CVE-2026-1796-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "stylebidet"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:]|]|]|]|]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1796", "description": "StyleBidet <=1.0.0 reflected XSS via $_SERVER[\'PHP_SELF\'] on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "stylebidet", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1800-01": {"action": "init", "conditions": [{"name": "ARGS:fmcfIdSelectedFnt", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-1800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1800", "description": "Fonts Manager | Custom Fonts <=1.2 unauthenticated SQL injection via fmcfIdSelectedFnt parameter", "method": "POST", "mode": "block", "severity": 7.5, "slug": "fonts-manager-custom-fonts", "tags": ["sql-injection", "unauthenticated", "no-patch"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2026-18021-01": {"ajax_action": "fl_builder_duplicate_wpml_layout", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-18021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18021", "description": "Beaver Builder Page Builder <=2.10.3.1 missing authorization on fl_builder_duplicate_wpml_layout AJAX handler allows layout duplication without a capability check", "mode": "block", "severity": 6.5, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.10.3.1"}, "RULE-CVE-2026-18039-01": {"action": "init", "conditions": [{"name": "ARGS:eael-register-submit", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~^(?:administrator|editor|author|shop_manager)$~i"}], "cve": "CVE-2026-18039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18039", "description": "Essential Addons for Elementor >=5.8.6 <6.7.2 unauthenticated privileged-role injection via front-end registration widget (register_user)", "mode": "block", "severity": 8.1, "slug": "essential-addons-for-elementor-lite", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": ">=5.8.6 <6.7.2"}, "RULE-CVE-2026-18039-02": {"ajax_action": "eael_lr_send_otp", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:administrator|editor|author|shop_manager)$~i"}], "cve": "CVE-2026-18039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18039", "description": "Essential Addons for Elementor >=5.8.6 <6.7.2 unauthenticated privileged-role injection via OTP registration send (eael_lr_send_otp)", "mode": "block", "severity": 8.1, "slug": "essential-addons-for-elementor-lite", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": ">=5.8.6 <6.7.2"}, "RULE-CVE-2026-1805-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~damedia_giglist[^]]*list_title[ ]*=[ ]*[\\"\'][^]]*(<[a-zA-Z]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1805", "description": "DAMedia GigList <=1.9.0 Stored XSS via damedia_giglist shortcode list_title attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "damedia-giglist", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2026-1805-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~damedia_giglist[^]]*list_title[ ]*=[ ]*[\\"\'][^]]*(<[a-zA-Z]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1805", "description": "DAMedia GigList <=1.9.0 Stored XSS via damedia_giglist shortcode list_title attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "damedia-giglist", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2026-18051-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:\\\\.|%2e|%252e){2}(?:[/\\\\\\\\]|%2f|%5c|%252f|%255c)~i"}], "cve": "CVE-2026-18051", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18051", "description": "W3 Total Cache <2.10.5 unauthenticated arbitrary file write via unvalidated REQUEST_URI used to build page-cache file names, including .htaccess overwrite on Apache", "mode": "block", "severity": 10.0, "slug": "w3-total-cache", "tags": ["path-traversal", "arbitrary-file-write", "unauthenticated", "htaccess-overwrite"], "target": "plugin", "versions": "<2.10.5"}, "RULE-CVE-2026-18052-01": {"action": "init", "conditions": [{"name": "ARGS:auto_login", "type": "exists"}, {"name": "ARGS:message_id", "type": "exists"}, {"name": "ARGS:username", "type": "regex", "value": "~^(?:admin|administrator|root|superadmin)$~i"}], "cve": "CVE-2026-18052", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18052", "description": "ManageWP Worker <4.9.37 unauthenticated privilege escalation via unbound automatic-login signature (username substitution to privileged account)", "mode": "block", "severity": 8.1, "slug": "worker", "tags": ["authentication-bypass", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<4.9.37"}, "RULE-CVE-2026-1808-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[ocplus_button\\\\b[^\\\\]]*style\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z0-9_]+\\\\s*=|]|]|]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-18109", "description": "W3 Total Cache <=2.10.3 unauthenticated stored XSS via comment author name re-emitted through Lazy Load img attribute rewriting", "mode": "block", "slug": "w3-total-cache", "target": "plugin", "versions": "<=2.10.3"}, "RULE-CVE-2026-18146-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "fluentform_submit"}, {"name": "REQUEST_COOKIES:/.+/", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-18146", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18146", "description": "Fluent Forms <=6.2.11 unauthenticated stored XSS via cookie-derived Notification Smartcode values in fluentform_submit", "mode": "block", "severity": 7.2, "slug": "fluentform", "tags": ["stored-xss", "unauthenticated", "input-validation"], "target": "plugin", "versions": "<=6.2.11"}, "RULE-CVE-2026-1820-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bvmalt_sc_div_update_alt_text[^\\\\]]*post_id[^\\\\]]*(?:]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-18323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18323", "description": "Forminator Forms <=1.57.0.2 unauthenticated stored XSS via radio field option-membership bypass in Save-and-Continue draft submission (forminator_submit_form_* AJAX action)", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["xss", "stored", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.57.0.2"}, "RULE-CVE-2026-18323-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_preview_form_~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-18323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18323", "description": "Forminator Forms <=1.57.0.2 unauthenticated stored XSS via radio field option-membership bypass in Save-and-Continue preview draft submission (forminator_submit_preview_form_* AJAX action)", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["xss", "stored", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.57.0.2"}, "RULE-CVE-2026-18324-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_(?:preview_)?form_~i"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*script\\\\b|<\\\\s*iframe\\\\b|<[^>]*\\\\bon[a-z]{3,15}\\\\s*=|(?:href|src|action|formaction)\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2026-18324", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18324", "description": "Forminator Forms <=1.57.0.1 unauthenticated stored XSS - script/event-handler payload submitted through a form field and rendered unescaped in the admin entries view (fixed upstream by wp_kses_post() on output)", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["xss", "stored-xss", "unauthenticated", "rich-text-editor"], "target": "plugin", "versions": "<=1.57.0.1"}, "RULE-CVE-2026-1833-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wamate-phone-blocker"}, {"name": "ARGS:blocked_numbers", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1833", "description": "WaMate Confirm <=2.0.1 missing authorization on phone blocker settings page allows authenticated users to block/unblock phone numbers", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wamate-confirm", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-1833-02": {"ajax_action": "grab_numbers_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1833", "description": "WaMate Confirm <=2.0.1 missing authorization on grab_numbers_action AJAX handler allows authenticated users to extract customer phone numbers", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wamate-confirm", "tags": ["missing-authorization", "broken-access-control", "data-exfiltration"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-18331-01": {"action": "init", "conditions": [{"name": "ARGS:frm_user_id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-18331", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18331", "description": "Formidable Forms <=6.33.1 unauthenticated stored XSS via frm_user_id privilege spoofing during entry submission", "mode": "block", "severity": 7.2, "slug": "formidable", "tags": ["xss", "stored", "unauthenticated", "privilege-spoofing"], "target": "plugin", "versions": "<=6.33.1"}, "RULE-CVE-2026-1834-01": {"ajax_action": "ive_ajax_save_template", "conditions": [{"name": "ARGS:template_data", "type": "regex", "value": "~]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1834", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1834", "description": "Ibtana Visual Editor <=1.2.5.7 stored XSS via ive_ajax_save_template template_data", "mode": "block", "severity": 6.4, "slug": "ibtana-visual-editor", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.2.5.7"}, "RULE-CVE-2026-18406-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/sureforms/v1/submit-form[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS", "type": "regex", "value": "~&(?:lt|#x?0*(?:3[cC]|60));?\\\\s*(?:script|img|svg|iframe|body|input)[\\\\s/>]~i"}], "cve": "CVE-2026-18406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18406", "description": "SureForms <=2.12.2 unauthenticated stored XSS via entity-encoded payload in submit-form REST endpoint", "mode": "block", "severity": 7.2, "slug": "sureforms", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.12.2"}, "RULE-CVE-2026-18406-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/sureforms/v1/submit-form[\\\\\\\\/]*$~i"}, {"name": "ARGS", "type": "regex", "value": "~&(?:lt|#x?0*(?:3[cC]|60));?\\\\s*(?:script|img|svg|iframe|body|input)[\\\\s/>]~i"}], "cve": "CVE-2026-18406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18406", "description": "SureForms <=2.12.2 unauthenticated stored XSS via entity-encoded payload in submit-form REST endpoint", "mode": "block", "severity": 7.2, "slug": "sureforms", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.12.2"}, "RULE-CVE-2026-1841-01": {"action": "init", "conditions": [{"name": "ARGS:pys_source", "type": "detectXSS"}], "cve": "CVE-2026-1841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1841", "description": "PixelYourSite <=11.2.0 stored XSS via unsanitized pys_source request parameter during checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=11.2.0"}, "RULE-CVE-2026-1841-02": {"action": "init", "conditions": [{"name": "ARGS:pys_landing", "type": "regex", "value": "~<[a-zA-Z/!]|javascript:~i"}], "cve": "CVE-2026-1841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1841", "description": "PixelYourSite <=11.2.0 stored XSS via unsanitized pys_landing request parameter during checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=11.2.0"}, "RULE-CVE-2026-1843-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]~i"}], "cve": "CVE-2026-1843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1843", "description": "Super Page Cache <=5.2.2 unauthenticated stored XSS via Activity Log - script tag injection", "method": "GET", "mode": "block", "severity": 7.2, "slug": "wp-cloudflare-page-cache", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-18442-01": {"action": "init", "conditions": [{"name": "ARGS:/wcfmmp_store_search|wcfmmp_radius_range|wcfmmp_radius_lat|wcfmmp_radius_lng/", "type": "regex", "value": "~(?:]|]|]|on(?:error|load|click|mouseover|focus|blur|mouseenter|pointerover)\\\\s*=|javascript\\\\s*:|[\\"\'][^\\"\'>]{0,20}(?:on[a-zA-Z]+\\\\s*=|javascript\\\\s*:))~i"}], "cve": "CVE-2026-18442", "description": "WCFM Marketplace - Multivendor Marketplace for WooCommerce <=3.8.2 unauthenticated reflected XSS via store-list search and radius filter parameters", "mode": "block", "slug": "wc-multivendor-marketplace", "target": "plugin", "versions": "<=3.8.2"}, "RULE-CVE-2026-18470-01": {"ajax_action": "xoo_el_form_action", "conditions": [{"name": "ARGS:_xoo_el_form", "type": "regex", "value": "~^lost[_-]?password$~i"}, {"name": "ARGS:user_login", "type": "exists"}], "cve": "CVE-2026-18470", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18470", "description": "Login & Register Forms (easy-login-woocommerce) <4.0.2 unauthenticated email address disclosure via xoo_el_form_action lost-password AJAX request", "mode": "block", "severity": 7.5, "slug": "easy-login-woocommerce", "tags": ["information-disclosure", "unauthenticated", "user-enumeration"], "target": "plugin", "versions": "<4.0.2"}, "RULE-CVE-2026-18488-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "wp:blocksy/dynamic-data"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"tagName\\"\\\\s*:\\\\s*\\"(?!(?:div|span|p|h[1-6])\\")[a-zA-Z0-9_-]*\\"~i"}], "cve": "CVE-2026-18488", "description": "Blocksy Companion <=2.1.51 stored XSS via tagName attribute in blocksy/dynamic-data block", "mode": "block", "slug": "blocksy-companion", "target": "plugin", "versions": "<=2.1.51"}, "RULE-CVE-2026-18547-01": {"action": "um_submit_form_profile", "conditions": [{"name": "ARGS:profile_nonce", "type": "exists"}, {"name": "ARGS:user_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[\\"\']\\\\s*(?:autofocus[^>]{0,60}onfocus\\\\s*=|onfocus\\\\s*=[^>]{0,60}autofocus)~i"}], "cve": "CVE-2026-18547", "description": "Ultimate Member <=2.12.1 authenticated (subscriber+) stored XSS via textarea profile field HTML-attribute breakout during profile form submission", "mode": "block", "slug": "ultimate-member", "target": "plugin", "versions": "<=2.12.1"}, "RULE-CVE-2026-1857-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kb-getresponse/v1/get(?:[/?&]|$)~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|&|\\\\?)endpoint=~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1857", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1857", "description": "Kadence Blocks <=3.6.1 authenticated (Contributor+) SSRF via endpoint parameter in GetResponse REST API route", "method": "GET", "mode": "block", "severity": 4.3, "slug": "kadence-blocks", "tags": ["ssrf", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2026-1860-01": {"ajax_action": "kaliforms_form_delete_uploaded_file", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:]*&#(?:0*(?:34|39|60|62)|x0*(?:22|27|3c|3e));~i"}], "cve": "CVE-2026-18978", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18978", "description": "LiteSpeed Cache <=7.8.1 unauthenticated stored XSS via numeric-entity (decimal or hex) encoded data-settings payload in comment content", "mode": "block", "severity": 7.2, "slug": "litespeed-cache", "tags": ["xss", "stored-xss", "unauthenticated", "comment-content"], "target": "plugin", "versions": "<=7.8.1"}, "RULE-CVE-2026-18983-01": {"action": "personal_options_update", "conditions": [{"name": "FILES:wpua-file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-18983", "description": "One User Avatar <=2.5.4 missing upload_files capability check on personal_options_update avatar upload branch", "mode": "block", "severity": 7.5, "slug": "one-user-avatar", "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2026-18983-02": {"action": "personal_options_update", "conditions": [{"name": "FILES:wpua-file", "type": "exists"}, {"name": "FILES:wpua-file:name", "type": "regex", "value": "~^(?!.*\\\\.(?:jpe?g|gif|png|webp|avif|heic)$).*$~i"}], "cve": "CVE-2026-18983", "description": "One User Avatar <=2.5.4 unrestricted file upload via MIME type bypass in wpua_action_process_option_update (personal_options_update) allowing non-image extensions such as dxfp", "mode": "block", "severity": 7.5, "slug": "one-user-avatar", "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2026-18983-03": {"action": "edit_user_profile_update", "conditions": [{"name": "FILES:wpua-file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-18983", "description": "One User Avatar <=2.5.4 missing upload_files capability check on edit_user_profile_update avatar upload branch", "mode": "block", "severity": 7.5, "slug": "one-user-avatar", "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2026-18983-04": {"action": "edit_user_profile_update", "conditions": [{"name": "FILES:wpua-file", "type": "exists"}, {"name": "FILES:wpua-file:name", "type": "regex", "value": "~^(?!.*\\\\.(?:jpe?g|gif|png|webp|avif|heic)$).*$~i"}], "cve": "CVE-2026-18983", "description": "One User Avatar <=2.5.4 unrestricted file upload via MIME type bypass in wpua_action_process_option_update (edit_user_profile_update) allowing non-image extensions such as dxfp", "mode": "block", "severity": 7.5, "slug": "one-user-avatar", "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2026-1900-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/link-whisper(?:-[a-z0-9-]+)?/v[0-9]+/[a-z0-9_/-]*(?:setting|option|config|update|save)~i"}, {"name": "ARGS:settings.keywords", "type": "regex", "value": "~(?:hacked|injected|evil|malware|();\\\\\\\\`]|[^\\\\s\\\\]]*[<>();\\\\\\\\`])~i"}], "cve": "CVE-2026-1902", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1902", "description": "Hammas Calendar <1.5.12 Stored XSS via apix shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "hammas-calendar", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<1.5.12"}, "RULE-CVE-2026-1903-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sb_ravelry_designs\\\\b[^\\\\]]*layout\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*[<>=()\\\\\\\\]|[\\"\'][^\\"\']*[\\"\'][><])~i"}], "cve": "CVE-2026-1903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1903", "description": "Ravelry Designs Widget <=1.0.0 Stored XSS via sb_ravelry_designs shortcode layout attribute in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ravelry-designs-widget", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1903-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sb_ravelry_designs\\\\b[^\\\\]]*layout\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*[<>=()\\\\\\\\]|[\\"\'][^\\"\']*[\\"\'][><])~i"}], "cve": "CVE-2026-1903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1903", "description": "Ravelry Designs Widget <=1.0.0 Stored XSS via sb_ravelry_designs shortcode layout attribute in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ravelry-designs-widget", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1905-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~show_sphere_image[^\\\\]]*width\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*on\\\\w+\\\\s*=|<\\\\s*script|javascript\\\\s*:|expression\\\\s*\\\\()~i"}], "cve": "CVE-2026-1905", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1905", "description": "Sphere Manager <=1.0.2 Stored XSS via show_sphere_image shortcode width attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sphere-manager", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1905-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~show_sphere_image[^\\\\]]*width\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*on\\\\w+\\\\s*=|<\\\\s*script|javascript\\\\s*:|expression\\\\s*\\\\()~i"}], "cve": "CVE-2026-1905", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1905", "description": "Sphere Manager <=1.0.2 Stored XSS via show_sphere_image shortcode width attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sphere-manager", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1909-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wavesurfer\\\\b[^\\\\]]*\\\\b(?:src|ogg)\\\\s*=\\\\s*(?:(?:\\"[^\\"]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\"]*\\")|(?:\'[^\']*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\']*\')|(?:[^\\\\s\\\\]]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\\\s\\\\]]*))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1909", "description": "WaveSurfer-WP <=2.8.3 Stored XSS via [wavesurfer] shortcode src attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wavesurfer-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2026-1909-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wavesurfer\\\\b[^\\\\]]*\\\\b(?:src|ogg)\\\\s*=\\\\s*(?:(?:\\"[^\\"]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\"]*\\")|(?:\'[^\']*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\']*\')|(?:[^\\\\s\\\\]]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\\\s\\\\]]*))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1909", "description": "WaveSurfer-WP <=2.8.3 Stored XSS via [wavesurfer] shortcode src attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wavesurfer-wp", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2026-19092-01": {"ajax_action": "tutor_render_lesson_content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:phpinfo|phpversion|php_uname|get_defined_vars|php_sapi_name|getcwd|get_current_user|phpcredits|session_start|opcache_reset|get_loaded_extensions|memory_get_usage|memory_get_peak_usage|error_get_last|apache_get_modules)$~i"}], "cve": "CVE-2026-19092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19092", "description": "Tutor LMS <4.0.6 unauthenticated arbitrary zero-argument PHP function invocation via tutor_render_lesson_content request data", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["unauthenticated", "injection", "arbitrary-function-invocation"], "target": "plugin", "versions": "<4.0.6"}, "RULE-CVE-2026-19092-02": {"ajax_action": "tutor_course_add_to_wishlist", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:phpinfo|phpversion|php_uname|get_defined_vars|php_sapi_name|getcwd|get_current_user|phpcredits|session_start|opcache_reset|get_loaded_extensions|memory_get_usage|memory_get_peak_usage|error_get_last|apache_get_modules)$~i"}], "cve": "CVE-2026-19092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19092", "description": "Tutor LMS <4.0.6 unauthenticated arbitrary zero-argument PHP function invocation via tutor_course_add_to_wishlist request data", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["unauthenticated", "injection", "arbitrary-function-invocation"], "target": "plugin", "versions": "<4.0.6"}, "RULE-CVE-2026-1910-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[upmenu-menu[^\\\\]]*lang[^\\\\]]*(?:<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1910", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1910", "description": "UpMenu <=3.1 Stored XSS via lang attribute of upmenu-menu shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "upmenu", "tags": ["xss", "stored-xss", "shortcode", "contributor"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2026-1910-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[upmenu-menu[^\\\\]]*lang[^\\\\]]*(?:<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1910", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1910", "description": "UpMenu <=3.1 Stored XSS via lang attribute of upmenu-menu shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "upmenu", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "contributor"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2026-1910-03": {"ajax_action": "ajaxUpdateOption", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1910", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1910", "description": "UpMenu <=3.1 unauthenticated arbitrary option update via ajaxUpdateOption AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "upmenu", "tags": ["missing-authorization", "unauthenticated", "arbitrary-option-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2026-1912-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ctdoi\\\\s+[^\\\\]]*code\\\\s*=\\\\s*[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|=1.40.0 <1.57.0.5 network-wide hub connector setting insufficiently restricted to network administrators on multisite via process_auth_callback", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["missing-authorization", "privilege-escalation", "multisite", "broken-access-control"], "target": "plugin", "versions": ">=1.40.0 <1.57.0.5"}, "RULE-CVE-2026-19221-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/hub-connector/v1/sync[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19221", "description": "Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector sync REST endpoint insufficiently restricted to network administrators on multisite", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["missing-authorization", "privilege-escalation", "multisite", "rest-api"], "target": "plugin", "versions": ">=1.40.0 <1.57.0.5"}, "RULE-CVE-2026-19221-03": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/hub-connector/v1/sync[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19221", "description": "Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector sync REST endpoint insufficiently restricted to network administrators on multisite", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["missing-authorization", "privilege-escalation", "multisite", "rest-api"], "target": "plugin", "versions": ">=1.40.0 <1.57.0.5"}, "RULE-CVE-2026-19221-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/hub-connector/v1/logout[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19221", "description": "Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector logout REST endpoint insufficiently restricted to network administrators on multisite", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["missing-authorization", "privilege-escalation", "multisite", "rest-api"], "target": "plugin", "versions": ">=1.40.0 <1.57.0.5"}, "RULE-CVE-2026-19221-05": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/hub-connector/v1/logout[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19221", "description": "Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector logout REST endpoint insufficiently restricted to network administrators on multisite", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["missing-authorization", "privilege-escalation", "multisite", "rest-api"], "target": "plugin", "versions": ">=1.40.0 <1.57.0.5"}, "RULE-CVE-2026-19222-01": {"ajax_action": "forminator_save_builder", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~\\"registration-role-field\\"\\\\s*:\\\\s*\\"(?:administrator|editor|shop_manager|author)\\"~i"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2026-19222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19222", "description": "Forminator Forms <1.57.0.7 improper privilege management allows form builders lacking create_users to assign the administrator role via forminator_save_builder registration settings", "mode": "block", "severity": 6.6, "slug": "forminator", "tags": ["privilege-escalation", "improper-authorization", "authenticated"], "target": "plugin", "versions": "<1.57.0.7"}, "RULE-CVE-2026-19223-01": {"ajax_action": "smush_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19223", "description": "Smush <4.3.2 site administrator can save network-wide plugin settings without network administrator capability via smush_save_settings AJAX handler", "mode": "block", "severity": 7.2, "slug": "wp-smushit", "tags": ["missing-authorization", "privilege-escalation", "multisite"], "target": "plugin", "versions": "<4.3.2"}, "RULE-CVE-2026-19223-02": {"ajax_action": "reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19223", "description": "Smush <4.3.2 site administrator can reset network-wide plugin settings without network administrator capability via reset_settings AJAX handler", "mode": "block", "severity": 7.2, "slug": "wp-smushit", "tags": ["missing-authorization", "privilege-escalation", "multisite"], "target": "plugin", "versions": "<4.3.2"}, "RULE-CVE-2026-1925-01": {"ajax_action": "emailkit_update_template_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1925", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1925", "description": "EmailKit <=1.6.2 missing authorization on emailkit_update_template_data AJAX handler allows subscriber+ post modification", "mode": "block", "severity": 4.3, "slug": "emailkit", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.6.2"}, "RULE-CVE-2026-1927-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v[0-9]+/figma_settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1927", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1927", "description": "GreenShift <=12.5.7 authenticated information disclosure via GET /greenshift/v1/figma_settings/ REST endpoint missing authorization", "method": "GET", "mode": "block", "severity": 4.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<=12.5.7"}, "RULE-CVE-2026-1927-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v[0-9]+/license_settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1927", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1927", "description": "GreenShift <=12.5.7 authenticated information disclosure via GET /greenshift/v1/license_settings/ REST endpoint missing authorization", "method": "GET", "mode": "block", "severity": 4.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<=12.5.7"}, "RULE-CVE-2026-1927-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v[0-9]+/figma_settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1927", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1927", "description": "GreenShift <=12.5.7 authenticated unauthorized settings update via POST /greenshift/v1/figma_settings/ REST endpoint missing authorization", "method": "POST", "mode": "block", "severity": 4.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "rest-api"], "target": "plugin", "versions": "<=12.5.7"}, "RULE-CVE-2026-1929-01": {"ajax_action": "awl-getSelectOptionValues", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|assert|eval|call_user_func|call_user_func_array|preg_replace|create_function|file_put_contents|file_get_contents|fwrite|fopen|include|require|include_once|require_once|unlink|rmdir|chmod|chown|curl_exec|mail|header|phpinfo|ob_start|register_shutdown_function|wp_insert_user|wp_set_password|update_option|delete_option|array_map|array_filter|array_walk|usort|uasort|uksort)$~i"}], "cve": "CVE-2026-1929", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1929", "description": "Advanced Woo Labels <=2.36 authenticated (Contributor+) RCE via arbitrary callback in awl-getSelectOptionValues AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "advanced-woo-labels", "tags": ["code-injection", "remote-code-execution", "missing-authorization"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-1931-01": {"ajax_action": "propertysearch", "conditions": [{"name": "ARGS:keyword", "type": "detectXSS"}], "cve": "CVE-2026-1931", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rentfetch", "target": "plugin", "versions": "<=0.32.6"}, "RULE-CVE-2026-1931-02": {"ajax_action": "floorplansearch", "conditions": [{"name": "ARGS:keyword", "type": "detectXSS"}], "cve": "CVE-2026-1931", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rentfetch", "target": "plugin", "versions": "<=0.32.6"}, "RULE-CVE-2026-1931-03": {"ajax_action": "rentfetch_track_search_view", "conditions": [{"name": "ARGS:keyword", "type": "detectXSS"}], "cve": "CVE-2026-1931", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rentfetch", "target": "plugin", "versions": "<=0.32.6"}, "RULE-CVE-2026-1932-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookr/v1/appointments(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1932", "description": "Bookr <=1.0.2 unauthenticated appointment status modification via REST API (POST)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "bookr", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1932-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookr/v1/appointments(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1932", "description": "Bookr <=1.0.2 unauthenticated appointment status modification via REST API (PUT)", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "bookr", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1937-01": {"ajax_action": "yaymail_import_state", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1937", "method": "POST", "mode": "block", "severity": 9.8, "slug": "yaymail", "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1938-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail-license/v1/license/delete(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1938", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1938", "description": "YayMail <=4.3.2 missing authorization on license/delete REST endpoint", "mode": "block", "severity": 5.3, "slug": "yaymail", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1938-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail-license/v1/license/activate(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1938", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1938", "description": "YayMail <=4.3.2 missing authorization on license/activate REST endpoint", "mode": "block", "severity": 5.3, "slug": "yaymail", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1938-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail-license/v1/license/update(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1938", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1938", "description": "YayMail <=4.3.2 missing authorization on license/update REST endpoint", "mode": "block", "severity": 5.3, "slug": "yaymail", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_events\\\\b[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|=2.6.7 <2.13.0 unauthenticated privilege escalation via submitted role field on registration/profile form", "mode": "block", "severity": 8.1, "slug": "ultimate-member", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": ">=2.6.7 <2.13.0"}, "RULE-CVE-2026-1943-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail/v1/templates(/|\\\\?|$)~"}, {"name": "ARGS:data", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1943", "description": "YayMail <=4.3.2 authenticated stored XSS via REST template update (rich_text in template_elements)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "yaymail", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1943-02": {"ajax_action": "yaymail_import_templates", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1943", "description": "YayMail <=4.3.2 authenticated stored XSS via AJAX template import (yaymail_import_templates)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "yaymail", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1943-03": {"ajax_action": "yaymail_import_state", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1943", "description": "YayMail <=4.3.2 authenticated stored XSS via AJAX state import (yaymail_import_state)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "yaymail", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1944-01": {"ajax_action": "cbk_save_v1", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1944", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1944", "description": "CallbackKiller Service Widget <=1.2 missing authorization on cbk_save_v1 AJAX action allows unauthenticated site ID modification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "callbackkiller-service-widget", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2026-1945-01": {"ajax_action": "wpb_ajax_post", "conditions": [{"name": "ARGS:wpb_user_name", "type": "regex", "value": "~<[^>]*>|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-1945", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1945", "description": "WPBookit <=1.0.8 unauthenticated stored XSS via wpb_user_name parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wpbookit", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-1945-02": {"ajax_action": "wpb_ajax_post", "conditions": [{"name": "ARGS:wpb_user_email", "type": "regex", "value": "~<[^>]*>|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-1945", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1945", "description": "WPBookit <=1.0.8 unauthenticated stored XSS via wpb_user_email parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wpbookit", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-1947-01": {"ajax_action": "submit_nex_form", "conditions": [{"name": "ARGS:nf_set_entry_update_id", "type": "exists"}], "cve": "CVE-2026-1947", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1947", "description": "NEX-Forms <=9.1.9 unauthenticated arbitrary form entry overwrite via IDOR in submit_nex_form (nf_set_entry_update_id)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "nex-forms-express-wp-form-builder", "tags": ["idor", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=9.1.9"}, "RULE-CVE-2026-1948-01": {"ajax_action": "deactivate_license", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1948", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1948", "description": "NEX-Forms <=9.1.9 missing authorization on deactivate_license AJAX handler allows Subscriber+ license deactivation", "mode": "block", "severity": 4.3, "slug": "nex-forms-express-wp-form-builder", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=9.1.9"}, "RULE-CVE-2026-19598-01": {"ajax_action": "pods_admin", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pods_admin"}, {"name": "ARGS:meta-box-loader", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19598", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19598", "description": "Pods authorization bypass (CWE-863) reachable unauthenticated via wp_ajax_nopriv_pods_admin. PodsAdmin::admin_ajax() enforces its method allowlist, login check, nonce check and pods_is_admin() capability gate exclusively through pods_error(). In the affected versions pods_error() takes a \\"json\\" error mode whenever wp_is_json_request() is true, and in that mode the meta-box-loader compatibility branch only writes the failure to the PHP error log and returns false instead of terminating the request. Every guard therefore becomes non-terminating and execution falls through to call_user_func([$api, $method]), letting an unauthenticated attacker reach PodsAPI methods such as save_pod - escalating to Administrator or overwriting any user\'s password. Fixed in 3.3.9.1 (and per-branch backports) by adding check_admin_referer(\'meta-box-loader\', \'meta-box-loader-nonce\') to that branch.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "pods", "tags": ["unauthenticated", "missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": ">=2.8 <=2.8.23.3 || >=2.9 <=2.9.19.3 || >=3.0 <=3.0.10.3 || >=3.1 <=3.1.4.1 || >=3.2 <=3.2.8.2 || >=3.3 <=3.3.9"}, "RULE-CVE-2026-19598-02": {"ajax_action": "pods_admin_components", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pods_admin_components"}, {"name": "ARGS:meta-box-loader", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19598", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19598", "description": "Same pods_error() authorization-bypass fuse as RULE-CVE-2026-19598-01, reached through wp_ajax_nopriv_pods_admin_components. PodsComponents::admin_ajax() gates the component method allowlist and its \'pods-component--\' nonce check solely through pods_error(); under the meta-box-loader compatibility path pods_error() returns false instead of terminating, so an unauthenticated request falls through to the component handler.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "pods", "tags": ["unauthenticated", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": ">=2.8 <=2.8.23.3 || >=2.9 <=2.9.19.3 || >=3.0 <=3.0.10.3 || >=3.1 <=3.1.4.1 || >=3.2 <=3.2.8.2 || >=3.3 <=3.3.9"}, "RULE-CVE-2026-19598-03": {"ajax_action": "pods_upload", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pods_upload"}, {"name": "ARGS:meta-box-loader", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-19598", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19598", "description": "Same pods_error() authorization-bypass fuse as RULE-CVE-2026-19598-01, reached through wp_ajax_nopriv_pods_upload. PodsField_File::admin_ajax_upload() enforces its method allowlist and the current_user_can(\'upload_files\') check only via pods_error(); under the meta-box-loader compatibility path pods_error() returns false instead of terminating, exposing the Pods upload handler to unauthenticated callers.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "pods", "tags": ["unauthenticated", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": ">=2.8 <=2.8.23.3 || >=2.9 <=2.9.19.3 || >=3.0 <=3.0.10.3 || >=3.1 <=3.1.4.1 || >=3.2 <=3.2.8.2 || >=3.3 <=3.3.9"}, "RULE-CVE-2026-19598-04": {"ajax_action": "pods_relationship", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pods_relationship"}, {"name": "ARGS:meta-box-loader", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-19598", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19598", "description": "Same pods_error() authorization-bypass fuse as RULE-CVE-2026-19598-01, reached through wp_ajax_nopriv_pods_relationship. PodsField_Pick::admin_ajax_relationship() enforces its required-parameter check and wp_verify_nonce() only via pods_error(); under the meta-box-loader compatibility path pods_error() returns false instead of terminating, so an unauthenticated caller reaches the relationship data handler.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "pods", "tags": ["unauthenticated", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": ">=2.8 <=2.8.23.3 || >=2.9 <=2.9.19.3 || >=3.0 <=3.0.10.3 || >=3.1 <=3.1.4.1 || >=3.2 <=3.2.8.2 || >=3.3 <=3.3.9"}, "RULE-CVE-2026-19615-02": {"action": "rest_insert_attachment", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2026-19615", "description": "Admin and Site Enhancements (ASE) <9.0.1 stored XSS via unsanitised SVG upload through REST attachment insertion", "mode": "block", "slug": "admin-site-enhancements", "target": "plugin", "versions": "<9.0.1"}, "RULE-CVE-2026-19632-01": {"ajax_action": "trp_get_translations_regular", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19632", "description": "TranslatePress <=3.3.1 unauthenticated sensitive information disclosure via trp_get_translations_regular AJAX action", "mode": "block", "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2026-19718-01": {"ajax_action": "bvadm", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19718", "description": "MalCare Security / BlogVault Backup & Staging / WP Remote <6.65 unauthenticated disclosure of remote-management secret-derived data via bvadm AJAX action (CWE-287)", "mode": "block", "severity": 8.1, "slug": "malcare-security", "tags": ["missing-authorization", "authentication-bypass", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<6.65"}, "RULE-CVE-2026-19722-01": {"ajax_action": "wpvivid_restore", "conditions": [{"name": "ARGS:backup_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|^[A-Za-z]:[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-19722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19722", "description": "WPvivid Backup, Migration & Staging <0.9.133 admin+ path traversal via backup_id in wpvivid_restore leading to arbitrary file write during restoration", "mode": "block", "severity": 6.6, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "backup-restore"], "target": "plugin", "versions": "<0.9.133"}, "RULE-CVE-2026-19722-02": {"ajax_action": "wpvivid_restore", "conditions": [{"name": "ARGS:restore_options", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|^[A-Za-z]:[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-19722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19722", "description": "WPvivid Backup, Migration & Staging <0.9.133 admin+ path traversal via restore_options in wpvivid_restore leading to arbitrary file write during restoration", "mode": "block", "severity": 6.6, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "backup-restore"], "target": "plugin", "versions": "<0.9.133"}, "RULE-CVE-2026-19722-03": {"ajax_action": "wpvivid_do_restore_2", "conditions": [{"name": "ARGS:backup_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|^[A-Za-z]:[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-19722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19722", "description": "WPvivid Backup, Migration & Staging <0.9.133 admin+ path traversal via backup_id in wpvivid_do_restore_2 leading to arbitrary file write during restoration", "mode": "block", "severity": 6.6, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "backup-restore"], "target": "plugin", "versions": "<0.9.133"}, "RULE-CVE-2026-19722-04": {"ajax_action": "wpvivid_do_restore_2", "conditions": [{"name": "ARGS:restore_options", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|^[A-Za-z]:[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-19722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19722", "description": "WPvivid Backup, Migration & Staging <0.9.133 admin+ path traversal via restore_options in wpvivid_do_restore_2 leading to arbitrary file write during restoration", "mode": "block", "severity": 6.6, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "backup-restore"], "target": "plugin", "versions": "<0.9.133"}, "RULE-CVE-2026-19725-01": {"ajax_action": "wpvivid_restore", "conditions": [{"name": "ARGS:backup_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|%2e%2e|%2f|%5c)~i"}], "cve": "CVE-2026-19725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19725", "description": "WPvivid Backup, Migration & Staging <0.9.131 unauthenticated log file path traversal via backup_id in wpvivid_restore AJAX action", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "unauthenticated", "arbitrary-file-write", "cwe-22"], "target": "plugin", "versions": "<0.9.131"}, "RULE-CVE-2026-19725-02": {"ajax_action": "wpvivid_get_restore_progress", "conditions": [{"name": "ARGS:backup_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|%2e%2e|%2f|%5c)~i"}], "cve": "CVE-2026-19725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19725", "description": "WPvivid Backup, Migration & Staging <0.9.131 unauthenticated log file path traversal via backup_id in wpvivid_get_restore_progress AJAX action", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "unauthenticated", "arbitrary-file-write", "cwe-22"], "target": "plugin", "versions": "<0.9.131"}, "RULE-CVE-2026-19769-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~(?:]|]|on(?:error|load|click|mouseover|focus|blur|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-19769", "description": "Ninja Forms <=3.15.1 unauthenticated stored XSS via repeater child key confusion in nf_ajax_submit formData", "mode": "block", "severity": 7.2, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.15.1"}, "RULE-CVE-2026-1980-01": {"ajax_action": "wpb_ajax_get", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "get_customer_list"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1980", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1980", "description": "WPBookit <=1.0.8 unauthenticated sensitive customer data exposure via get_customer_list route", "mode": "block", "severity": 5.3, "slug": "wpbookit", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-1981-01": {"ajax_action": "winston_disconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1981", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1981", "description": "Winston AI <=0.0.3 missing authorization on winston_disconnect AJAX handler allows subscriber+ API disconnection", "mode": "block", "severity": 4.3, "slug": "winston-ai-wp", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.0.3"}, "RULE-CVE-2026-1981-02": {"ajax_action": "winston_link_website", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1981", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1981", "description": "Winston AI <=0.0.3 missing authorization on winston_link_website AJAX handler allows subscriber+ site linking", "mode": "block", "severity": 4.3, "slug": "winston-ai-wp", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.0.3"}, "RULE-CVE-2026-1981-03": {"ajax_action": "winston_verify_website", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1981", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1981", "description": "Winston AI <=0.0.3 missing authorization on winston_verify_website AJAX handler allows subscriber+ site verification", "mode": "block", "severity": 4.3, "slug": "winston-ai-wp", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.0.3"}, "RULE-CVE-2026-1983-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "seatt"}, {"name": "ARGS:remove_event", "type": "regex", "value": "~.+~"}, {"name": "ARGS:event_id", "type": "regex", "value": "~^[0-9]+$~"}], "cve": "CVE-2026-1983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1983", "description": "Simple Event Attendance <=1.5.0 CSRF vulnerability allowing unauthenticated event deletion via forged requests", "method": "GET", "mode": "block", "severity": 4.3, "slug": "simple-event-attendance", "tags": ["csrf", "missing-authorization", "unauthenticated", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-19848-01": {"ajax_action": "pp_ajax_signup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[\\\\/?[a-zA-Z][a-zA-Z0-9_-]{0,30}(?:\\\\s[^\\\\[\\\\]]{0,200})?\\\\]~"}], "cve": "CVE-2026-19848", "description": "ProfilePress (wp-user-avatar) <4.17.1 unauthenticated stored shortcode injection via pp_ajax_signup registration fields", "mode": "block", "slug": "wp-user-avatar", "target": "plugin", "versions": "<4.17.1"}, "RULE-CVE-2026-19848-02": {"ajax_action": "pp_ajax_editprofile", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[\\\\/?[a-zA-Z][a-zA-Z0-9_-]{0,30}(?:\\\\s[^\\\\[\\\\]]{0,200})?\\\\]~"}], "cve": "CVE-2026-19848", "description": "ProfilePress (wp-user-avatar) <4.17.1 authenticated stored shortcode injection via pp_ajax_editprofile profile field update", "mode": "block", "slug": "wp-user-avatar", "target": "plugin", "versions": "<4.17.1"}, "RULE-CVE-2026-1985-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~press3d[/\\\\\\\\]model[^}]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1985", "description": "Press3D <=1.0.2 authenticated (Author+) stored XSS via javascript: URI in 3D Model block linkUrl attribute via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "press3d", "tags": ["xss", "stored", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-19855-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~\\\\[[a-zA-Z_][a-zA-Z0-9_-]*(?:\\\\s+[a-zA-Z_][a-zA-Z0-9_=\\"\'\\\\s]*)?\\\\]~i"}], "cve": "CVE-2026-19855", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19855", "description": "CleanTalk Spam Protect <6.87 unauthenticated shortcode injection via wp-comments-post.php comment content", "mode": "block", "severity": 6.5, "slug": "cleantalk-spam-protect", "tags": ["shortcode-injection", "unauthenticated", "stored-injection"], "target": "plugin", "versions": "<6.87"}, "RULE-CVE-2026-1987-01": {"ajax_action": "scheduler_widget_save_event", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1987", "description": "Scheduler Widget <=0.1.6 IDOR allows Subscriber+ to modify arbitrary events via scheduler_widget_save_event AJAX action", "method": "POST", "mode": "block", "severity": 5.4, "slug": "scheduler-widget", "tags": ["idor", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.1.6"}, "RULE-CVE-2026-1987-02": {"ajax_action": "scheduler_widget_delete_event", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1987", "description": "Scheduler Widget <=0.1.6 IDOR allows Subscriber+ to delete arbitrary events via scheduler_widget_delete_event AJAX action", "method": "POST", "mode": "block", "severity": 5.4, "slug": "scheduler-widget", "tags": ["idor", "missing-authorization", "broken-access-control", "unauthorized-deletion"], "target": "plugin", "versions": "<=0.1.6"}, "RULE-CVE-2026-1988-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|[%]2[eE][%]2[eE][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-1988-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:php|phar|data|expect|zip)(?:://|[%]3[aA][%]2[fF][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute (PHP wrapper variant)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "php-wrapper", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-1988-03": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|[%]2[eE][%]2[eE][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute in content field", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-1988-04": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:php|phar|data|expect|zip)(?:://|[%]3[aA][%]2[fF][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute in content field (PHP wrapper variant)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "php-wrapper", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-19883-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wpematico-action", "type": "equals", "value": "import_settings"}, {"name": "FILES:txtsettings", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19883", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19883", "description": "WPeMatico RSS Feed Fetcher <=2.8.24 missing capability check on wpematico_import_settings allows subscriber-level arbitrary option update and privilege escalation", "mode": "block", "slug": "wpematico", "target": "plugin", "versions": "<=2.8.24"}, "RULE-CVE-2026-19883-02": {"ajax_action": "process_button_click", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19883", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19883", "description": "WPeMatico RSS Feed Fetcher <=2.8.24 missing capability check on process_button_click AJAX handler allows unauthenticated option toggle", "mode": "block", "slug": "wpematico", "target": "plugin", "versions": "<=2.8.24"}, "RULE-CVE-2026-1993-01": {"ajax_action": "exactmetrics_vue_update_settings", "conditions": [{"name": "ARGS:setting", "type": "equals", "value": "save_settings"}, {"name": "ARGS:value", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings save_settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1993-02": {"ajax_action": "exactmetrics_vue_update_settings", "conditions": [{"name": "ARGS:setting", "type": "equals", "value": "view_reports"}, {"name": "ARGS:value", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings view_reports", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1993-04": {"ajax_action": "exactmetrics_vue_update_settings_bulk", "conditions": [{"name": "ARGS:settings", "type": "regex", "value": "~save_settings~i"}, {"name": "ARGS:settings", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings_bulk save_settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1993-05": {"ajax_action": "exactmetrics_vue_update_settings_bulk", "conditions": [{"name": "ARGS:settings", "type": "regex", "value": "~view_reports~i"}, {"name": "ARGS:settings", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings_bulk view_reports", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1994-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "register"}, {"name": "ARGS:ws_plugin__s2member_custom_reg_field_user_pass1", "type": "exists"}], "cve": "CVE-2026-1994", "method": "POST", "mode": "block", "slug": "s2member", "target": "plugin", "versions": "<=260127"}, "RULE-CVE-2026-19949-01": {"ajax_action": "ai1wm_import", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\\\\\\'){20,}~"}], "cve": "CVE-2026-19949", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19949", "description": "All-in-One WP Migration and Backup <=7.109 unauthenticated SQL injection via archive restore due to unescaped backslash-terminated quoted values in ai1wm_import processing", "mode": "block", "severity": 8.8, "slug": "all-in-one-wp-migration", "tags": ["sql-injection", "unauthenticated", "archive-restore"], "target": "plugin", "versions": "<=7.109"}, "RULE-CVE-2026-19991-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(https?://[^\\\\s<>]{3,200}?)\\\\.\\\\.\\\\1~i"}], "cve": "CVE-2026-19991", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19991", "description": "UsersWP <=1.2.70 arbitrary file deletion via crafted file/image URL that collapses into path traversal in uwp_get_file_relative_url() before upload_file_remove() deletion", "mode": "block", "severity": 8.1, "slug": "userswp", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.2.70"}, "RULE-CVE-2026-2001-01": {"ajax_action": "revx_install", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-2001", "method": "POST", "mode": "block", "severity": 8.8, "slug": "revenue", "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-2020-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(post|admin-ajax)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(jQueryArchiveList|JSArchiveList|JsArchiveList)[^\\\\]]*(?:included|excluded)[^\\\\]]*[OC]:[0-9]+:~i"}], "cve": "CVE-2026-2020", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2020", "description": "JS Archive List <=6.1.7 PHP Object Injection via shortcode included/excluded attributes (post.php/admin-ajax save)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "shortcode"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-2020-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(jQueryArchiveList|JSArchiveList|JsArchiveList)[^\\\\]]*(?:included|excluded)[^\\\\]]*[OC]:[0-9]+:~i"}], "cve": "CVE-2026-2020", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2020", "description": "JS Archive List <=6.1.7 PHP Object Injection via shortcode included/excluded attributes (REST /wp/v2/posts)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-2020-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(jQueryArchiveList|JSArchiveList|JsArchiveList)[^\\\\]]*(?:included|excluded)[^\\\\]]*[OC]:[0-9]+:~i"}], "cve": "CVE-2026-2020", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2020", "description": "JS Archive List <=6.1.7 PHP Object Injection via shortcode included/excluded attributes (REST /wp/v2/pages)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-2022-01": {"ajax_action": "rednao_smart_forms_get_campaigns", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2022", "method": "POST", "mode": "block", "severity": 4.3, "slug": "smart-forms", "target": "plugin", "versions": "<2.7.0"}, "RULE-CVE-2026-2023-01": {"ajax_action": "wppic_save_custom_plugin", "conditions": [{"name": "ARGS:wppicFormData[slug]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2023", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2023", "description": "WP Plugin Info Card <=6.2.0 Cross-Site Request Forgery via disabled nonce in wppic_save_custom_plugin AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-plugin-info-card", "tags": ["csrf", "missing-nonce"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-2024-01": {"ajax_action": "myajax-submit", "conditions": [{"name": "ARGS:postid", "type": "detectSQLi"}], "cve": "CVE-2026-2024", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2024", "description": "PhotoStack Gallery <=0.4.1 unauthenticated SQL injection via postid parameter in myajax-submit AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "photostack-gallery", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2026-2025-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mailmint/v1/contacts(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2025", "description": "Mail Mint <1.19.5 unauthenticated access to contacts REST API endpoint exposing user email addresses", "method": "GET", "mode": "block", "severity": 7.5, "slug": "mail-mint", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<1.19.5"}, "RULE-CVE-2026-2027-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:amp_enhancer_custom_css_settings[amp_custom_css]", "type": "regex", "value": "~<\\\\s*(?:script|/style)|\\\\bexpression\\\\s*\\\\(|\\\\burl\\\\s*\\\\(\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|-moz-binding\\\\s*:\\\\s*url|\\\\bbehavior\\\\s*:\\\\s*url~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2027", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2027", "description": "AMP Enhancer <=1.0.49 authenticated stored XSS via AMP Custom CSS setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "amp-enhancer", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.49"}, "RULE-CVE-2026-2029-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[labb_pricing_item\\\\b[^\\\\]]*(?:<|�*60;?|�*3[cC];?)(?:script|img|svg|iframe|details|object|embed|link|meta|body|input|select|textarea|button|form|marquee|video|audio|source|math|style)[ \\\\t>/]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2029", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2029", "description": "Livemesh Addons for Beaver Builder <=3.9.2 Stored XSS via labb_pricing_item shortcode title/value attributes (htmlspecialchars_decode after wp_kses_post)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addons-for-beaver-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.9.2"}, "RULE-CVE-2026-2052-01": {"ajax_action": "widgetopts_ajax_validate_expression", "conditions": [{"name": "ARGS:expression", "type": "regex", "value": "~(?:array_map\\\\s*\\\\(\\\\s*[\'\\"]|array_reduce\\\\s*\\\\(\\\\s*[\'\\"]|create_function\\\\s*\\\\(|preg_replace\\\\s*\\\\(\\\\s*[\'\\"][^\'\\"]*\\\\/e[\'\\"]|(?:call_user_func|call_user_func_array)\\\\s*\\\\()~i"}], "cve": "CVE-2026-2052", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2052", "description": "Widget Options <=4.2.2 authenticated RCE via Display Logic expression bypass using eval-triggering PHP functions", "mode": "block", "severity": 8.8, "slug": "widget-options", "tags": ["remote-code-execution", "code-injection", "authenticated", "bypass"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2026-2144-01": {"action": "init", "conditions": [{"name": "ARGS:uid", "type": "regex", "value": "~^[+]?0*(?:[1-5])$~"}, {"name": "ARGS:token", "type": "regex", "value": "~^[a-f0-9]{20,}$~"}], "cve": "CVE-2026-2144", "method": "GET", "mode": "block", "severity": 8.1, "slug": "magic-login-mail", "target": "plugin", "versions": "<2.07"}, "RULE-CVE-2026-22193-01": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions email parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22193-02": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:activation_key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions activation_key parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22193-03": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:subscription_date", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions subscription_date parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22193-04": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:imported_from", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions imported_from parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22201-01": {"ajax_action": "wpdAddComment", "conditions": [{"name": "REQUEST_HEADERS:Client-IP", "type": "regex", "value": "~^\\\\s*(?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\s*$~"}], "cve": "CVE-2026-22201", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22201", "description": "wpDiscuz <=7.6.54 IP spoofing via Client-IP header allows bypass of IP-based rate limiting and ban enforcement", "mode": "block", "severity": 5.3, "slug": "wpdiscuz", "tags": ["ip-spoofing", "rate-limit-bypass", "unauthenticated"], "target": "plugin", "versions": "<=7.6.54"}, "RULE-CVE-2026-22202-01": {"ajax_action": "wpdiscuzDeleteDataWithEmail", "conditions": [{"name": "ARGS:commentemail", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22202", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22202", "description": "wpDiscuz <=7.6.54 unauthenticated/low-privilege destructive comment deletion via wpdiscuzDeleteDataWithEmail AJAX action (CSRF)", "mode": "block", "severity": 6.5, "slug": "wpdiscuz", "tags": ["cross-site-request-forgery", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=7.6.54"}, "RULE-CVE-2026-22209-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wpdiscuz_form"}, {"name": "ARGS", "type": "regex", "value": "~\\\\s*(?:<\\\\s*(?:script[\\\\s/>]|svg\\\\b|img\\\\b|iframe\\\\b|body\\\\b|input\\\\b)|[^<]*on[a-z]+\\\\s*=)~i"}], "cve": "CVE-2026-22209", "description": "wpDiscuz <7.6.47 admin-authenticated stored XSS via unescaped customCss in wpdiscuz_form CPT rendered inside style tag", "mode": "block", "severity": 5.5, "slug": "wpdiscuz", "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22216-01": {"ajax_action": "wpdAddSubscription", "conditions": [{"name": "ARGS:subscribe_email", "type": "regex", "value": "~[%*?]~"}], "cve": "CVE-2026-22216", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22216", "description": "wpDiscuz <=7.6.54 unauthenticated subscription flood via LIKE wildcard email enumeration", "mode": "block", "severity": 5.3, "slug": "wpdiscuz", "tags": ["missing-rate-limiting", "unauthenticated", "email-enumeration"], "target": "plugin", "versions": "<=7.6.54"}, "RULE-CVE-2026-2230-01": {"ajax_action": "AJAX_SAVE_USER_META_DATA", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2230", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2230", "description": "Booking Calendar <=10.14.14 authenticated IDOR allows subscriber+ to modify other users booking meta via AJAX_SAVE_USER_META_DATA", "method": "POST", "mode": "block", "severity": 4.3, "slug": "booking", "tags": ["idor", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=10.14.14"}, "RULE-CVE-2026-2231-01": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:first_name", "type": "regex", "value": "~(?:]|]|]|]|]|]|]|]|]|]|]|]|<[a-z]+[^>]*\\\\bon[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-22352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22352", "description": "Persian WooCommerce SMS <=7.1.1 reflected XSS via order_status parameter in change_sms_text AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "persian-woocommerce-sms", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2026-22353-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "teachpress/authors.php"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]+onload\\\\s*=)~i"}], "cve": "CVE-2026-22353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22353", "description": "teachPress <=9.0.12 contributor+ reflected XSS via search parameter on authors admin page", "method": "GET", "mode": "block", "severity": 6.5, "slug": "teachpress", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.0.12"}, "RULE-CVE-2026-22353-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "teachpress/addpublications.php"}, {"name": "ARGS:tags", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]+onload\\\\s*=)~i"}], "cve": "CVE-2026-22353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22353", "description": "teachPress <=9.0.12 contributor+ stored XSS via tags parameter on add publication admin page", "method": "POST", "mode": "block", "severity": 6.5, "slug": "teachpress", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=9.0.12"}, "RULE-CVE-2026-22353-03": {"ajax_action": "tp_document_upload", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "tp_document_upload"}, {"name": "ARGS:/^(async-upload|name)$/", "type": "regex", "value": "~(?:]|]+onload\\\\s*=|]+onerror\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-22353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22353", "description": "teachPress <=9.0.12 contributor+ reflected XSS via async-upload parameter in tp_document_upload AJAX handler", "mode": "block", "severity": 6.5, "slug": "teachpress", "tags": ["xss", "reflected", "authenticated", "ajax"], "target": "plugin", "versions": "<=9.0.12"}, "RULE-CVE-2026-22357-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:orderby", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via orderby parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:order", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via order parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:post_mime_type", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via post_mime_type parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:detached", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via detached parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:type", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via type parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:category", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via category parameter in admin error table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via post_id parameter in admin error/click tables", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-08": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:codes", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via codes parameter in admin error/report tables", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-09": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:link_min_count", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via link_min_count parameter in report search", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-10": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:link_max_count", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via link_max_count parameter in report search", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-11": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper_settings"}, {"name": "ARGS:tab", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via tab parameter in settings page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-12": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper_settings"}, {"name": "ARGS:setting_highlight", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via setting_highlight parameter in settings page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-13": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:keywords", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via keywords parameter in click details page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22361-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22361", "description": "a-mart theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "a-mart", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22361-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22361", "description": "a-mart theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "a-mart", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22362", "description": "photolia theme <= 1.0.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "photolia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22362-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22362", "description": "photolia theme <= 1.0.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "photolia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22363-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22363", "description": "rhodos theme <= 1.3.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rhodos", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2026-22363-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22363", "description": "rhodos theme <= 1.3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rhodos", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2026-22364-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22364", "description": "seventrees theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "seventrees", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22364-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22364", "description": "seventrees theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "seventrees", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22365-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22365", "description": "soleng theme <= 1.0.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "soleng", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.5"}, "RULE-CVE-2026-22365-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22365", "description": "soleng theme <= 1.0.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "soleng", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.5"}, "RULE-CVE-2026-22366-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22366", "description": "jude theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "jude", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22366-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22366", "description": "jude theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "jude", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22367", "description": "coworking theme <= 1.6.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "coworking", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2026-22367-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22367", "description": "coworking theme <= 1.6.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "coworking", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2026-22368-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22368", "description": "redy theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "redy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22368-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22368", "description": "redy theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "redy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22369", "description": "ironfit theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ironfit", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22369-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22369", "description": "ironfit theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ironfit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22370-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22370", "description": "marveland theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "marveland", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22370-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22370", "description": "marveland theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "marveland", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22371-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22371", "description": "gustavo theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gustavo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22371-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22371", "description": "gustavo theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gustavo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22372-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22372", "description": "isida theme <= 1.4.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "isida", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-22372-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22372", "description": "isida theme <= 1.4.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "isida", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-22373-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22373", "description": "fooddy theme <= 1.3.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fooddy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.10"}, "RULE-CVE-2026-22373-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22373", "description": "fooddy theme <= 1.3.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fooddy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.10"}, "RULE-CVE-2026-22374-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22374", "description": "zioalberto theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "zioalberto", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22374-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22374", "description": "zioalberto theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "zioalberto", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22375-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22375", "description": "impacto-patronus theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "impacto-patronus", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22375-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22375", "description": "impacto-patronus theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "impacto-patronus", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22376-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22376", "description": "parkivia theme <= 1.1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "parkivia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22376-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22376", "description": "parkivia theme <= 1.1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "parkivia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22377-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22377", "description": "saveo theme <= 1.1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "saveo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22377-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22377", "description": "saveo theme <= 1.1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "saveo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22378-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22378", "description": "blabber theme <= 1.7.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "blabber", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2026-22378-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22378", "description": "blabber theme <= 1.7.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "blabber", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2026-22379-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22379", "description": "netmix theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "netmix", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-22379-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22379", "description": "netmix theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "netmix", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-22380-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22380", "description": "unlimhost theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "unlimhost", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22380-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22380", "description": "unlimhost theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "unlimhost", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22381-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22381", "description": "pawfriends theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pawfriends", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22381-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22381", "description": "pawfriends theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pawfriends", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22387-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22387", "description": "aviana theme <= 2.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "aviana", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22387-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22387", "description": "aviana theme <= 2.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "aviana", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22389-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22389", "description": "cocco theme <= 1.5.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cocco", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.5.1"}, "RULE-CVE-2026-22389-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22389", "description": "cocco theme <= 1.5.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cocco", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.1"}, "RULE-CVE-2026-22390-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "ba_cheetah_disable"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22390", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22390", "description": "Builderall Builder for WordPress <=3.0.1 missing authorization on ba_cheetah_disable AJAX handler", "mode": "block", "severity": 9.9, "slug": "builderall-cheetah-for-wp", "tags": ["missing-authorization", "broken-access-control", "ajax"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-22390-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "ba_cheetah_duplicate_wpml_layout"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22390", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22390", "description": "Builderall Builder for WordPress <=3.0.1 missing authorization on ba_cheetah_duplicate_wpml_layout AJAX handler", "mode": "block", "severity": 9.9, "slug": "builderall-cheetah-for-wp", "tags": ["missing-authorization", "broken-access-control", "ajax"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-22392-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22392", "description": "cortex theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cortex", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22392-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22392", "description": "cortex theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cortex", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22394-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22394", "description": "evently theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "evently", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22394-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22394", "description": "evently theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "evently", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22395-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22395", "description": "fiorello theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fiorello", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22395-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22395", "description": "fiorello theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fiorello", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22397-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22397", "description": "fleur theme <= 2.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fleur", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.0"}, "RULE-CVE-2026-22397-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22397", "description": "fleur theme <= 2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fleur", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.0"}, "RULE-CVE-2026-22399-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22399", "description": "holmes theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "holmes", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22399-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22399", "description": "holmes theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "holmes", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22403-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22403", "description": "innovio theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "innovio", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22403-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22403", "description": "innovio theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "innovio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22405-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22405", "description": "overton theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "overton", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22405-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22405", "description": "overton theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "overton", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22408-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22408", "description": "justicia theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "justicia", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22408-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22408", "description": "justicia theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "justicia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22410-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22410", "description": "dolcino theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dolcino", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22410-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22410", "description": "dolcino theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dolcino", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22412-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22412", "description": "eona theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "eona", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22412-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22412", "description": "eona theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "eona", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22413-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22413", "description": "malgre theme <= 1.0.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "malgre", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22413-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22413", "description": "malgre theme <= 1.0.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "malgre", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22414-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22414", "description": "marra theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "marra", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22414-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22414", "description": "marra theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "marra", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22415-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22415", "description": "the-mounty theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "the-mounty", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22415-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22415", "description": "the-mounty theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "the-mounty", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22416-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22416", "description": "fixteam theme <= 1.5.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fixteam", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2026-22416-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22416", "description": "fixteam theme <= 1.5.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fixteam", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2026-22418-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22418", "description": "great-lotus theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "great-lotus", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-22418-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22418", "description": "great-lotus theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "great-lotus", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-22419-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22419", "description": "honor theme <= 2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "honor", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.3"}, "RULE-CVE-2026-22419-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22419", "description": "honor theme <= 2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "honor", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.3"}, "RULE-CVE-2026-22420-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22420", "description": "horizon theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "horizon", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22420-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22420", "description": "horizon theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "horizon", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22421-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22421", "description": "quantum theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "quantum", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22421-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22421", "description": "quantum theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "quantum", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22424-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22424", "description": "shaha theme <= 1.1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "shaha", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22424-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22424", "description": "shaha theme <= 1.1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "shaha", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22427-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22427", "description": "gotravel theme <= 2.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gotravel", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22427-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22427", "description": "gotravel theme <= 2.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gotravel", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22428-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22428", "description": "tooth-fairy theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tooth-fairy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2026-22428-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22428", "description": "tooth-fairy theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tooth-fairy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2026-22429-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22429", "description": "verdure theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "verdure", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22429-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22429", "description": "verdure theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "verdure", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22431-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22431", "description": "wabi-sabi theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wabi-sabi", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22431-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22431", "description": "wabi-sabi theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wabi-sabi", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22432-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22432", "description": "woopy theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "woopy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22432-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22432", "description": "woopy theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "woopy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22433-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22433", "description": "cloudme theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cloudme", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22433-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22433", "description": "cloudme theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cloudme", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22434", "description": "crown-art theme <= 1.2.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "crown-art", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2026-22434-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22434", "description": "crown-art theme <= 1.2.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "crown-art", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2026-22435-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22435", "description": "electroserv theme <= 1.3.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "electroserv", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22435-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22435", "description": "electroserv theme <= 1.3.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "electroserv", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22437-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22437", "description": "playa theme <= 1.3.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "playa", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.9"}, "RULE-CVE-2026-22437-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22437", "description": "playa theme <= 1.3.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "playa", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.9"}, "RULE-CVE-2026-22439-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22439", "description": "green-planet theme <= 1.1.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "green-planet", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.14"}, "RULE-CVE-2026-22439-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22439", "description": "green-planet theme <= 1.1.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "green-planet", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.14"}, "RULE-CVE-2026-22440-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/(?:index\\\\.php)?(?:\\\\?|$)|/(?:archive|blog)(?:/|\\\\?|$))~i"}, {"name": "ARGS:/^(?:s|q|redirect)$/", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouse(?:over|down|up)|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-22440", "mode": "block", "severity": 7.1, "target": "core", "versions": ">=1.0.0"}, "RULE-CVE-2026-22446-01": {"ajax_action": "prowess_select_blog_load_more", "conditions": [{"name": "ARGS:blogType", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|proc/self)|%2[Ee]|%5[Cc])~i"}], "cve": "CVE-2026-22446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22446", "description": "Prowess <=1.8.1 unauthenticated local file inclusion via blogType parameter", "mode": "block", "severity": 8.1, "slug": "prowess", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2026-22446-02": {"ajax_action": "prowess_select_blog_shortcode_load_more", "conditions": [{"name": "ARGS:blogType", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|proc/self)|%2[Ee]|%5[Cc])~i"}], "cve": "CVE-2026-22446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22446", "description": "Prowess <=1.8.1 unauthenticated local file inclusion via blogType parameter (shortcode endpoint)", "mode": "block", "severity": 8.1, "slug": "prowess", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2026-22449-01": {"ajax_action": "donpeppe_select_blog_load_more", "conditions": [{"name": "ARGS:blogType", "type": "regex", "value": "~(?:[.][.][/.]{2}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-22449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22449", "description": "Don Peppe Theme <=1.3 local file inclusion via blogType parameter in donpeppe_select_blog_load_more", "mode": "block", "severity": 8.1, "slug": "donpeppe", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22449-02": {"ajax_action": "donpeppe_select_blog_shortcode_load_more", "conditions": [{"name": "ARGS:blogType", "type": "regex", "value": "~(?:[.][.][/.]{2}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-22449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22449", "description": "Don Peppe Theme <=1.3 local file inclusion via blogType parameter in shortcode handler", "mode": "block", "severity": 8.1, "slug": "donpeppe", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22457-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22457", "description": "wanderland theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wanderland", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22457-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22457", "description": "wanderland theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wanderland", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22460-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/formgent/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/](?:wp-config\\\\.php|\\\\.htaccess|\\\\.env)|/etc/passwd~i"}], "cve": "CVE-2026-22460", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22460", "description": "FormGent <=1.5.4 unauthenticated arbitrary file deletion via path traversal in REST API", "mode": "block", "severity": 8.6, "slug": "formgent", "tags": ["path-traversal", "arbitrary-file-deletion", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2026-22472-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "set_setting_Emsfb"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22472", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22472", "description": "Easy Form Builder <=3.9.6 missing authorization on set_setting_Emsfb AJAX action allows subscriber+ settings manipulation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-form-builder", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=3.9.6"}, "RULE-CVE-2026-22472-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "add_addons_Emsfb"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22472", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22472", "description": "Easy Form Builder <=3.9.6 missing authorization on add_addons_Emsfb AJAX action allows subscriber+ arbitrary addon installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-form-builder", "tags": ["missing-authorization", "broken-access-control", "arbitrary-file-install"], "target": "plugin", "versions": "<=3.9.6"}, "RULE-CVE-2026-22477-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22477", "description": "felizia theme <= 1.3.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "felizia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.4"}, "RULE-CVE-2026-22477-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22477", "description": "felizia theme <= 1.3.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "felizia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.4"}, "RULE-CVE-2026-22480-01": {"ajax_action": "pf_export_ajax_basic", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:[0-9]+:\\\\\\"~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22480", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22480", "description": "Product Feed for WooCommerce <=2.3.3 PHP object injection via form_data in pf_export_ajax_basic", "mode": "block", "severity": 7.2, "slug": "webtoffee-product-feed", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2026-22480-02": {"ajax_action": "pf_schedule_ajax", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:[0-9]+:\\\\\\"~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22480", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22480", "description": "Product Feed for WooCommerce <=2.3.3 PHP object injection via form_data in pf_schedule_ajax", "mode": "block", "severity": 7.2, "slug": "webtoffee-product-feed", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2026-22481-01": {"ajax_action": "save_courier_settings", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on save_courier_settings AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22481-02": {"ajax_action": "refresh_courier_data_edit", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on refresh_courier_data_edit AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22481-03": {"ajax_action": "refresh_courier_data_list", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on refresh_courier_data_list AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22481-04": {"ajax_action": "fetch_order_ratios", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on fetch_order_ratios AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22482-01": {"ajax_action": "wb_scrapy_image", "conditions": [{"name": "ARGS:op", "type": "regex", "value": "~^(?:scrapy|down)$~"}, {"name": "ARGS:image", "type": "regex", "value": "~(?:^https?://(?:localhost(?=[:/]|$)|127\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|0\\\\.0\\\\.0\\\\.0(?=[:/]|$)|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|169\\\\.254\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|\\\\[::1\\\\](?=[:/]|$)|0x[0-9a-f]{8}(?=[:/]|$))|^file://)~i"}], "cve": "CVE-2026-22482", "method": "POST", "mode": "block", "severity": 9.1, "slug": "imgspider", "target": "plugin", "versions": "<2.3.13"}, "RULE-CVE-2026-22495-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22495", "description": "greenville theme <= 1.3.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "greenville", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22495-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22495", "description": "greenville theme <= 1.3.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "greenville", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22496-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22496", "description": "hypnotherapy theme <= 1.2.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hypnotherapy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.10"}, "RULE-CVE-2026-22496-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22496", "description": "hypnotherapy theme <= 1.2.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hypnotherapy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.10"}, "RULE-CVE-2026-22502-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22502", "description": "mr-cobbler theme <= 1.1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "mr-cobbler", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22502-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22502", "description": "mr-cobbler theme <= 1.1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "mr-cobbler", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22507-01": {"ajax_action": "beelove_options_import", "conditions": [{"name": "ARGS:/option_value|import_data/", "type": "regex", "value": "~^(?:[OC]:[0-9]+:\\"|a:[0-9]+:\\\\{)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22507", "description": "BeeLove <=1.2.6 unauthenticated PHP object injection via beelove_options_import AJAX action", "mode": "block", "severity": 9.8, "slug": "beelove", "tags": ["php-object-injection", "deserialization", "unauthenticated", "cwe-502"], "target": "theme", "versions": "<=1.2.6"}, "RULE-CVE-2026-22507-02": {"ajax_action": "beelove_options_save", "conditions": [{"name": "ARGS:option_value", "type": "regex", "value": "~^(?:[OC]:[0-9]+:\\"|a:[0-9]+:\\\\{)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22507", "description": "BeeLove <=1.2.6 unauthenticated PHP object injection via beelove_options_save AJAX action", "mode": "block", "severity": 9.8, "slug": "beelove", "tags": ["php-object-injection", "deserialization", "unauthenticated", "cwe-502"], "target": "theme", "versions": "<=1.2.6"}, "RULE-CVE-2026-22508-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22508", "description": "dentalux theme <= 3.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dentalux", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=3.3"}, "RULE-CVE-2026-22508-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22508", "description": "dentalux theme <= 3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dentalux", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.3"}, "RULE-CVE-2026-22513-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22513", "description": "triompher theme <= 1.1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "triompher", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2026-22513-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22513", "description": "triompher theme <= 1.1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "triompher", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2026-22514-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22514", "description": "unica theme <= 1.4.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "unica", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.1"}, "RULE-CVE-2026-22514-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22514", "description": "unica theme <= 1.4.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "unica", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.1"}, "RULE-CVE-2026-22515-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22515", "description": "vegadays theme <= 1.2.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "vegadays", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.0"}, "RULE-CVE-2026-22515-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22515", "description": "vegadays theme <= 1.2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "vegadays", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.0"}, "RULE-CVE-2026-22516-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22516", "description": "wizors-investments theme <= 2.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wizors-investments", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.12"}, "RULE-CVE-2026-22516-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22516", "description": "wizors-investments theme <= 2.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wizors-investments", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.12"}, "RULE-CVE-2026-22522-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/block-slider/~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22522", "description": "Block Slider <=2.2.3 broken access control on REST API endpoints allows subscriber+ unauthorized data access", "mode": "block", "severity": 6.5, "slug": "block-slider", "tags": ["missing-authorization", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=2.2.3"}, "RULE-CVE-2026-2268-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~\\\\{post_meta:[^}]+\\\\}~i"}], "cve": "CVE-2026-2268", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.14.0"}, "RULE-CVE-2026-2268-02": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~\\\\{user_meta:[^}]+\\\\}~i"}], "cve": "CVE-2026-2268", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.14.0"}, "RULE-CVE-2026-2279-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "list_links"}, {"name": "ARGS:sort_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|CONCAT\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|;\\\\s*(?:SELECT|DROP|ALTER|CREATE|INSERT|UPDATE|DELETE)|--\\\\s|/\\\\*|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-2279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2279", "description": "myLinksDump <=1.6 authenticated (Administrator+) SQL Injection via sort_by parameter in ORDER BY clause", "method": "GET", "mode": "block", "severity": 7.2, "slug": "mylinksdump", "tags": ["sql-injection", "order-by-injection", "authenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2026-2279-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "list_links"}, {"name": "ARGS:sort_order", "type": "regex", "value": "~^(?!(?:ASC|DESC)$).+~i"}], "cve": "CVE-2026-2279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2279", "description": "myLinksDump <=1.6 authenticated (Administrator+) SQL Injection via sort_order parameter in ORDER BY clause", "method": "GET", "mode": "block", "severity": 7.2, "slug": "mylinksdump", "tags": ["sql-injection", "order-by-injection", "authenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2026-22850-01": {"action": "init", "conditions": [{"name": "ARGS:pa", "type": "regex", "value": "~[)\'][ ]*[,;][ ]*(?:[(][ ]*[\'\\"]|DROP |DELETE |INSERT |UPDATE |SELECT |ALTER |TRUNCATE |CREATE |--)~i"}], "cve": "CVE-2026-22850", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22850", "description": "Koko Analytics <2.1.3 stored SQL injection via pa tracking parameter", "mode": "block", "severity": 8.3, "slug": "koko-analytics", "tags": ["sql-injection", "stored-sqli", "tracking"], "target": "plugin", "versions": "<2.1.3"}, "RULE-CVE-2026-22850-02": {"action": "init", "conditions": [{"name": "ARGS:r", "type": "regex", "value": "~[)\'][ ]*[,;][ ]*(?:[(][ ]*[\'\\"]|DROP |DELETE |INSERT |UPDATE |SELECT |ALTER |TRUNCATE |CREATE |--)~i"}], "cve": "CVE-2026-22850", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22850", "description": "Koko Analytics <2.1.3 stored SQL injection via r referrer parameter", "mode": "block", "severity": 8.3, "slug": "koko-analytics", "tags": ["sql-injection", "stored-sqli", "tracking"], "target": "plugin", "versions": "<2.1.3"}, "RULE-CVE-2026-2295-01": {"ajax_action": "wpz_posts_grid_load_more", "conditions": [{"name": "ARGS:posts_data", "type": "regex", "value": "~\\"post_status\\"[ ]*:~i"}], "cve": "CVE-2026-2295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2295", "description": "WPZOOM Addons for Elementor <=1.3.2 unauthenticated information disclosure via post_status injection in wpz_posts_grid_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wpzoom-elementor-addons", "tags": ["information-disclosure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2026-2296-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcpa/~"}, {"name": "ARGS", "type": "regex", "value": "~[();`$]|\\\\bsystem\\\\b|\\\\bexec\\\\b|\\\\bpassthru\\\\b|\\\\bshell_exec\\\\b|\\\\bpopen\\\\b|\\\\bproc_open\\\\b|\\\\beval\\\\b|\\\\bassert\\\\b|\\\\bphpinfo\\\\b|\\\\bbase64_decode\\\\b|\\\\bfile_get_contents\\\\b|\\\\bfile_put_contents\\\\b|\\\\bchr\\\\s*\\\\(|\\\\bpack\\\\s*\\\\(~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-2296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2296", "description": "Product Addons for Woocommerce <=3.1.0 authenticated (Shop Manager+) PHP code injection via conditional logic operator field in REST API", "method": "POST", "mode": "block", "severity": 7.2, "slug": "woo-custom-product-addons", "tags": ["code-injection", "rce", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2026-2305-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:aFhfc_head_code", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2305", "description": "AddFunc Head & Footer Code <=2.3 stored XSS via aFhfc_head_code", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addfunc-head-footer-code", "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2026-2305-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:aFhfc_body_code", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2305", "description": "AddFunc Head & Footer Code <=2.3 stored XSS via aFhfc_body_code", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addfunc-head-footer-code", "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2026-2305-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:aFhfc_footer_code", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2305", "description": "AddFunc Head & Footer Code <=2.3 stored XSS via aFhfc_footer_code", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addfunc-head-footer-code", "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2026-2351-01": {"ajax_action": "get_text_from_url_tm", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:^|/)(?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2351", "description": "Task Manager <=3.0.2 arbitrary file read via get_text_from_url_tm AJAX handler", "mode": "block", "severity": 6.5, "slug": "task-manager", "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-2352-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:ao_post_preload", "type": "regex", "value": "~(?:on(?:load|error|mouseover|focus|click|keydown|mouseenter)[ ]*=|]|javascript[ ]*:|\\"[ ]*(?:autofocus|style|tabindex|accesskey)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2026-2352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2352", "description": "Autoptimize <=3.1.14 authenticated stored XSS via ao_post_preload meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "autoptimize", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.1.14"}, "RULE-CVE-2026-23549-01": {"ajax_action": "mep_re_ajax_load_ticket_type_list", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_re_ajax_load_ticket_type_list", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23549-02": {"ajax_action": "mep_re_ajax_load_extra_service_list", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_re_ajax_load_extra_service_list", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23549-03": {"ajax_action": "mep_re_ajax_load_ticket_time_list", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_re_ajax_load_ticket_time_list", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23549-04": {"ajax_action": "mep_event_list_date_schedule", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_event_list_date_schedule", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23550-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/modular-connector/login/.*~i"}], "config": {}, "cve": "CVE-2026-23550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23550", "description": "Modular Connector <=2.5.1 unauthenticated privilege escalation in the Modular DS/Modular Connector plugin caused by incorrect privilege assignment and an overly permissive custom routing layer that allows crafted unauthenticated requests to reach login-related endpoints and obtain elevated privileges, as described by NVD, Patchstack, and the vendor advisory.", "mode": "block", "severity": 10.0, "slug": "modular-connector", "tags": ["priv-esc", "auth-bypass", "modular-connector", "routing"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-23550-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(api/modular-connector|api-modular-connector)/(login|lb|oauth)/[^/?]+~i"}], "config": {}, "cve": "CVE-2026-23550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23550", "description": "Heuristic coverage for Modular Connector <=2.5.1 privilege escalation where unauthenticated attackers can reach internal login-related routes handled by the plugin\\u2019s custom router (for example, variants of an /api-modular-connector/login path) because routing middleware is bypassed, enabling admin-login behavior consistent with external analyses of this CVE.", "mode": "block", "severity": 10.0, "slug": "modular-connector", "tags": ["priv-esc", "auth-bypass", "modular-connector", "routing"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-2356-01": {"ajax_action": "user_registration_membership_register_member", "conditions": [{"name": "ARGS:members_data", "type": "regex", "value": "~\\"payment_method\\"\\\\s*:\\\\s*\\"\\"~"}], "cve": "CVE-2026-2356", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2356", "description": "User Registration & Membership <=5.1.2 unauthenticated IDOR user deletion via register_member AJAX handler (empty payment_method path)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["idor", "improper-access-control", "unauthenticated", "user-deletion"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-2358-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]wp_ulike_likers_box[^]]*template[ ]*=[ ]*[\\"\'][^\\"\']*(?:&#(?:0*60|[xX]0*3[cC]);?|<)[ ]*(?:script|img|svg|iframe|details|object|embed|body|marquee|video|audio|input|select|textarea|form|button|a[ ])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-2358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2358", "description": "WP ULike <=5.0.1 Stored XSS via [wp_ulike_likers_box] shortcode template attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-ulike", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-2358-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]wp_ulike_likers_box[^]]*template[ ]*=[ ]*[\\"\'][^\\"\']*(?:&#(?:0*60|[xX]0*3[cC]);?|<)[ ]*(?:script|img|svg|iframe|details|object|embed|body|marquee|video|audio|input|select|textarea|form|button|a[ ])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-2358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2358", "description": "WP ULike <=5.0.1 Stored XSS via [wp_ulike_likers_box] shortcode template attribute in REST API post/page save", "mode": "block", "severity": 6.4, "slug": "wp-ulike", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-2362-01": {"ajax_action": "save-attachment", "conditions": [{"name": "ARGS:changes[alt]", "type": "regex", "value": "~<[a-zA-Z][^>]*on[a-zA-Z]+=|<(script|svg|iframe|embed|object|math|xmp|noscript)|javascript\\\\s*:~i"}], "cve": "CVE-2026-2362", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2362", "description": "WP Accessibility <=2.3.1 Stored DOM-Based XSS via image alt text in save-attachment AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-accessibility", "tags": ["xss", "stored-dom-xss", "media-library"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-2365-01": {"ajax_action": "fluentform_step_form_save_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2026-2365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2365", "description": "Fluent Forms <=6.1.17 unauthenticated stored XSS via fluentform_step_form_save_data AJAX draft endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "fluentform", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=6.1.17"}, "RULE-CVE-2026-2367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "[ays_block"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|]*\\\\bon|]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2367", "description": "Secure Copy Content Protection <= 5.0.1 Stored XSS via ays_block shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "secure-copy-content-protection", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-2367-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[ays_block"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|]*\\\\bon|]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2367", "description": "Secure Copy Content Protection <= 5.0.1 Stored XSS via ays_block shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "secure-copy-content-protection", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-23694-01": {"ajax_action": "ahsc_reset_options", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-23694", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23694", "description": "Aruba HiSpeed Cache <3.0.5 CSRF on ahsc_reset_options allows unauthenticated settings reset", "mode": "block", "severity": 4.3, "slug": "aruba-hispeed-cache", "tags": ["csrf", "missing-nonce", "unauthenticated"], "target": "plugin", "versions": "<3.0.5"}, "RULE-CVE-2026-23694-02": {"ajax_action": "ahsc_debug_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-23694", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23694", "description": "Aruba HiSpeed Cache <3.0.5 CSRF on ahsc_debug_status allows unauthenticated WP_DEBUG toggle", "mode": "block", "severity": 4.3, "slug": "aruba-hispeed-cache", "tags": ["csrf", "missing-nonce", "unauthenticated"], "target": "plugin", "versions": "<3.0.5"}, "RULE-CVE-2026-23694-03": {"ajax_action": "ahsc_enable_purge", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-23694", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23694", "description": "Aruba HiSpeed Cache <3.0.5 CSRF on ahsc_enable_purge allows unauthenticated cache purge config change", "mode": "block", "severity": 4.3, "slug": "aruba-hispeed-cache", "tags": ["csrf", "missing-nonce", "unauthenticated"], "target": "plugin", "versions": "<3.0.5"}, "RULE-CVE-2026-2371-01": {"ajax_action": "gspb_el_reusable_load", "conditions": [{"type": "missing_capability", "value": "read"}, {"name": "ARGS:post_id", "type": "exists"}], "cve": "CVE-2026-2371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2371", "description": "GreenShift <=12.8.3 unauthenticated IDOR disclosure of private/draft/password-protected reusable blocks via gspb_el_reusable_load AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "idor", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=12.8.3"}, "RULE-CVE-2026-2373-05": {"ajax_action": "wpr_get_filtered_count_products", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:grid_settings[post_type]", "type": "regex", "value": "~^(?!post$|page$|product$|attachment$|nav_menu_item$|revision$|custom_css$|customize_changeset$|oembed_cache$|user_request$|wp_block$|wp_template$|wp_template_part$|wp_global_styles$|wp_navigation$|elementor_library$)[a-z][a-z0-9_-]{1,31}$~i"}], "cve": "CVE-2026-2373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2373", "description": "Royal Elementor Addons <=1.7.1049 unauthenticated CPT count exposure via wpr_get_filtered_count_products", "mode": "block", "severity": 5.3, "slug": "royal-elementor-addons", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1049"}, "RULE-CVE-2026-2373-06": {"ajax_action": "wpr_get_media_filtered_count", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:grid_settings[post_type]", "type": "regex", "value": "~^(?!post$|page$|product$|attachment$|nav_menu_item$|revision$|custom_css$|customize_changeset$|oembed_cache$|user_request$|wp_block$|wp_template$|wp_template_part$|wp_global_styles$|wp_navigation$|elementor_library$)[a-z][a-z0-9_-]{1,31}$~i"}], "cve": "CVE-2026-2373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2373", "description": "Royal Elementor Addons <=1.7.1049 unauthenticated CPT count exposure via wpr_get_media_filtered_count", "mode": "block", "severity": 5.3, "slug": "royal-elementor-addons", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1049"}, "RULE-CVE-2026-2374-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-login\\\\.php|/xmlrpc\\\\.php)/.*(?:<[a-zA-Z]|%3[cC][a-zA-Z]|%253[cC])~i"}], "cve": "CVE-2026-2374", "description": "Login No Captcha reCAPTCHA <=1.8.0 unauthenticated stored XSS via PATH_INFO in $_SERVER[\'PHP_SELF\'] on wp-login.php/xmlrpc.php", "mode": "block", "severity": 7.2, "slug": "login-recaptcha", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-23800-01": {"action": "plugins_loaded", "conditions": [{"name": "ARGS:origin", "type": "equals", "value": "mo"}, {"name": "ARGS:type", "type": "equals", "value": "request"}, {"name": "ARGS:mrid", "type": "regex", "value": "~.+~"}, {"name": "ARGS:sig", "type": "regex", "value": "~.+~"}], "cve": "CVE-2026-23800", "method": "GET", "mode": "block", "severity": 10.0, "slug": "modular-connector", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-23806-01": {"action": "init", "conditions": [{"name": "ARGS:job-search", "type": "regex", "value": "~(?:UNION[\\\\s/*]+(?:ALL[\\\\s/*]+)?SELECT[\\\\s/*]|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|[\'\\")0-9]\\\\s*--\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-23806", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23806", "description": "Jobs for WordPress <=2.8 unauthenticated SQL injection via job-search shortcode parameter", "mode": "block", "severity": 7.5, "slug": "job-postings", "tags": ["sql-injection", "unauthenticated", "shortcode", "broken-access-control"], "target": "plugin", "versions": "<=2.8"}, "RULE-CVE-2026-23807-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wptelegram_widget_view"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-23807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23807", "description": "WP Telegram Widget <=2.2.13 unauthenticated reflected XSS via wptelegram_widget_view admin-post handler", "mode": "block", "severity": 7.1, "slug": "wptelegram-widget", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=2.2.13"}, "RULE-CVE-2026-2386-01": {"ajax_action": "tpae_create_page", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~^(?:page|nxt_builder)$~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2026-2386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2386", "description": "The Plus Addons for Elementor <=6.4.7 incorrect authorization in tpae_create_page allows Author+ to create restricted post type drafts via post_type parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["incorrect-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=6.4.7"}, "RULE-CVE-2026-23977-01": {"action": "init", "conditions": [{"name": "ARGS:stswpro_save_ticket", "type": "exists"}, {"name": "ARGS:post_title", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-23977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23977", "description": "Helpdesk Support Ticket System for WooCommerce <=2.1.2 unauthorized ticket creation via WooCommerce tickets endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "support-ticket-system-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "ticket-creation", "frontend"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2026-2410-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wdanp-edit-redirects"}, {"name": "ARGS:wdan_add_block", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2410", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2410", "description": "Disable Admin Notices <=1.4.1 CSRF on blocked redirect URL addition via wdanp-edit-redirects admin page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "disable-admin-notices", "tags": ["csrf", "cross-site-request-forgery", "settings-change"], "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2026-2416-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:sort", "type": "detectSQLi"}], "cve": "CVE-2026-2416", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2416", "description": "Geo Mashup <=1.13.17 unauthenticated SQL injection via sort parameter in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.13.17"}, "RULE-CVE-2026-2416-02": {"ajax_action": "geo_mashup_suggest_custom_keys", "conditions": [{"name": "ARGS:sort", "type": "detectSQLi"}], "cve": "CVE-2026-2416", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2416", "description": "Geo Mashup <=1.13.17 authenticated SQL injection via sort parameter in geo_mashup_suggest_custom_keys AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "ajax"], "target": "plugin", "versions": "<=1.13.17"}, "RULE-CVE-2026-2420-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "ltm_popup_group"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2420", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2420", "description": "LotekMedia Popup Form <=1.0.6 stored XSS via plugin settings", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ltm-popup-form", "tags": ["stored-xss", "authenticated", "settings"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-2429-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "save_community_events_venues"}, {"name": "ARGS:ce_csv_import", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2429", "description": "Community Events <=1.5.8 authenticated (admin+) SQL injection via ce_venue_name CSV field in venue import", "method": "POST", "mode": "block", "severity": 4.9, "slug": "community-events", "tags": ["sql-injection", "csv-import", "authenticated"], "target": "plugin", "versions": "<=1.5.8"}, "RULE-CVE-2026-2430-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~]*src=[\\"\'][^\\"\']*[ \\\\t\\\\n\\\\r]src=~i"}], "cve": "CVE-2026-2430", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2430", "description": "Autoptimize <=3.1.14 Stored XSS via crafted img tag in post_content exploiting lazy-load regex", "method": "POST", "mode": "block", "severity": 6.4, "slug": "autoptimize", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.1.14"}, "RULE-CVE-2026-2430-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~]*src=[\\"\'][^\\"\']*[ \\\\t\\\\n\\\\r]src=~i"}], "cve": "CVE-2026-2430", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2430", "description": "Autoptimize <=3.1.14 Stored XSS via crafted img tag in REST API post content exploiting lazy-load regex", "method": "POST", "mode": "block", "severity": 6.4, "slug": "autoptimize", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.1.14"}, "RULE-CVE-2026-2431-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "cm-custom-reports"}, {"name": "ARGS:date_from", "type": "regex", "value": "~(?:<|>|\\"|\'|on[a-zA-Z0-9_]+[ ]*=|script|svg|img)~i"}], "cve": "CVE-2026-2431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2431", "description": "CM Custom Reports <=1.2.7 Reflected XSS via date_from parameter on admin reports page", "mode": "block", "severity": 6.1, "slug": "cm-custom-reports", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2026-2431-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "cm-custom-reports"}, {"name": "ARGS:date_to", "type": "regex", "value": "~(?:<|>|\\"|\'|on[a-zA-Z0-9_]+[ ]*=|script|svg|img)~i"}], "cve": "CVE-2026-2431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2431", "description": "CM Custom Reports <=1.2.7 Reflected XSS via date_to parameter on admin reports page", "mode": "block", "severity": 6.1, "slug": "cm-custom-reports", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2026-24353-01": {"ajax_action": "user_registration_membership_register_member", "conditions": [{"name": "ARGS:members_data", "type": "regex", "value": "~(?:administrator|editor|manage_options|delete_users|edit_users)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24353", "description": "User Registration <= 4.4.9 privilege escalation via membership registration allowing non-admin role assignment", "method": "POST", "mode": "block", "severity": 8.1, "slug": "user-registration", "tags": ["priv-esc", "role-assignment"], "target": "plugin", "versions": "<=4.4.9"}, "RULE-CVE-2026-24357-01": {"ajax_action": "wprm_reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_reset_settings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-02": {"ajax_action": "wprm_export_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_export_settings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-03": {"ajax_action": "wprm_import_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_import_settings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-04": {"ajax_action": "wprm_export_templates", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_export_templates AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-05": {"ajax_action": "wprm_import_templates", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_import_templates AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-06": {"ajax_action": "wprm_anonymize_ratings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_anonymize_ratings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "data-manipulation"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-07": {"ajax_action": "wprm_analytics_export_csv", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_analytics_export_csv AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-08": {"ajax_action": "wprm_health_check", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_health_check AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24359-01": {"ajax_action": "dokan_handle_withdraw_request", "conditions": [{"name": "ARGS:amount", "type": "exists"}, {"name": "ARGS:withdraw", "type": "exists"}, {"type": "missing_capability", "value": "dokan_manage_withdraw"}], "config": {}, "cve": "CVE-2026-24359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24359", "description": "Dokan Lite <=4.2.4 missing authorization on vendor withdrawal operations allows authenticated vendor to process unauthorized withdrawals", "method": "POST", "mode": "block", "severity": 8.8, "slug": "dokan-lite", "tags": ["missing-authorization", "broken-authentication", "privilege-escalation"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2026-24361-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/learnpress/v1/reviews(?:[/?&]|$)~"}, {"name": "ARGS:title", "type": "regex", "value": "~(?:]|on[a-z]+\\\\s*=|javascript\\\\s*:|]|]|]|])~i"}], "cve": "CVE-2026-24361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24361", "description": "LearnPress Course Review <=4.1.9 stored XSS via title on learnpress/v1 review REST submission", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress-course-review", "tags": ["xss", "stored", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.1.9"}, "RULE-CVE-2026-24361-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/learnpress/v1/reviews(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:]|on[a-z]+\\\\s*=|javascript\\\\s*:|]|]|]|])~i"}], "cve": "CVE-2026-24361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24361", "description": "LearnPress Course Review <=4.1.9 stored XSS via content on learnpress/v1 review REST submission", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress-course-review", "tags": ["xss", "stored", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.1.9"}, "RULE-CVE-2026-24373-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?!/wp-admin/)~"}, {"name": "ARGS:form_id", "type": "exists"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:^|\\\\s)(?:administrator|editor|author|contributor)(?:\\\\s|$)~i"}], "cve": "CVE-2026-24373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24373", "description": "RegistrationMagic <=6.0.7.1 unauthenticated privilege escalation via rm_user_role parameter in registration form submission", "method": "POST", "mode": "block", "severity": 8.1, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=6.0.7.1"}, "RULE-CVE-2026-24374-01": {"ajax_action": "rm_activate_rm_user", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24374", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24374", "description": "RegistrationMagic <= 6.0.6.9 broken authentication on user activation allowing non-admin account takeover", "method": "POST", "mode": "block", "severity": 5.4, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.6.9"}, "RULE-CVE-2026-24377-01": {"ajax_action": "tpgb_get_template_content", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-24377", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24377", "description": "Nexter Blocks <=4.6.3 unauthenticated sensitive data exposure via tpgb_get_template_content AJAX handler", "mode": "block", "severity": 7.5, "slug": "the-plus-addons-for-block-editor", "tags": ["sensitive-data-exposure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.6.3"}, "RULE-CVE-2026-24378-01": {"ajax_action": "eventprime_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-24378", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24378", "description": "EventPrime <=4.2.8.0 unauthenticated PHP object injection via eventprime_api AJAX handler", "mode": "block", "severity": 9.8, "slug": "eventprime-event-calendar-management", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=4.2.8.0"}, "RULE-CVE-2026-24382-01": {"ajax_action": "newsx_activate_required_plugins", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-24382", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24382", "description": "News Magazine X <=1.2.50 unauthenticated plugin activation via newsx_activate_required_plugins AJAX handler", "mode": "block", "severity": 7.5, "slug": "news-magazine-x", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "theme", "versions": "<=1.2.50"}, "RULE-CVE-2026-24383-01": {"ajax_action": "bsbPosts", "conditions": [{"name": "ARGS:queryAttr", "type": "regex", "value": "~(?i)(]|]|]*onerror[\\\\s]*=|]*onload[\\\\s]*=|on(?:error|load|click|mouseover|focus|blur|toggle)[\\\\s]*=|=\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2026-24389", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24389", "description": "Gallery PhotoBlocks <=1.3.2 stored XSS via custom event fields in gallery save for users without unfiltered_html capability", "mode": "block", "severity": 6.5, "slug": "photoblocks-grid-gallery", "tags": ["xss", "stored", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2026-2440-01": {"ajax_action": "SurveyJS_SaveResult", "conditions": [{"name": "ARGS:Json", "type": "regex", "value": "~&(amp;)?#(?:x0*(?:3[cC]|3[eE]|2[27fF]|3[bB]|2[28fF]|2[29fF])|0*(?:60|62|34|39|59|40|41));~i"}], "cve": "CVE-2026-2440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2440", "description": "SurveyJS <=2.5.3 stored XSS via HTML-entity-encoded payloads in Json survey result submissions", "method": "POST", "mode": "block", "severity": 7.2, "slug": "surveyjs", "tags": ["xss", "stored-xss", "unauthenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-2442-01": {"ajax_action": "pagelayer_contact_submit", "conditions": [{"name": "ARGS:/pagelayer_name|pagelayer_email|pagelayer_subject|pagelayer_message/", "type": "regex", "value": "~[\\\\r\\\\n]~"}], "cve": "CVE-2026-2442", "description": "PageLayer <=2.0.7 CRLF injection via contact form submission allows email header injection", "mode": "block", "severity": 5.3, "slug": "pagelayer", "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2026-2448-01": {"ajax_action": "so_panels_live_editor_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|%2e%2e[%2f%5c\\\\\\\\]|%252e%252e[%2f%5c\\\\\\\\%]|\\\\\\\\u002e\\\\\\\\u002e(?:\\\\\\\\u002[fF]|\\\\\\\\u005[cC]))~i"}], "cve": "CVE-2026-2448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2448", "description": "Page Builder by SiteOrigin <=2.33.5 Local File Inclusion via path traversal in live editor preview", "method": "POST", "mode": "block", "severity": 8.8, "slug": "siteorigin-panels", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=2.33.5"}, "RULE-CVE-2026-2448-02": {"ajax_action": "so_panels_layout_block_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|%2e%2e[%2f%5c\\\\\\\\]|%252e%252e[%2f%5c\\\\\\\\%]|\\\\\\\\u002e\\\\\\\\u002e(?:\\\\\\\\u002[fF]|\\\\\\\\u005[cC]))~i"}], "cve": "CVE-2026-2448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2448", "description": "Page Builder by SiteOrigin <=2.33.5 Local File Inclusion via path traversal in layout block preview", "method": "POST", "mode": "block", "severity": 8.8, "slug": "siteorigin-panels", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=2.33.5"}, "RULE-CVE-2026-2448-03": {"ajax_action": "so_panels_builder_content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|%2e%2e[%2f%5c\\\\\\\\]|%252e%252e[%2f%5c\\\\\\\\%]|\\\\\\\\u002e\\\\\\\\u002e(?:\\\\\\\\u002[fF]|\\\\\\\\u005[cC]))~i"}], "cve": "CVE-2026-2448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2448", "description": "Page Builder by SiteOrigin <=2.33.5 Local File Inclusion via path traversal in builder content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "siteorigin-panels", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=2.33.5"}, "RULE-CVE-2026-24523-01": {"ajax_action": "WP_FullCalendar", "conditions": [{"name": "ARGS:type", "type": "equals", "value": "attachment"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24523", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24523", "description": "WP FullCalendar <=1.6 unauthenticated attachment enumeration via WP_FullCalendar AJAX action with type=attachment", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-fullcalendar", "tags": ["sensitive-data-exposure", "information-disclosure", "ajax", "unauthenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2026-24524-01": {"ajax_action": "store_tablesome_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24524", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24524", "description": "Tablesome <1.2.4 missing authorization on store_tablesome_data AJAX handler allows low-privilege users to modify table data", "method": "POST", "mode": "block", "severity": 8.1, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.2.4"}, "RULE-CVE-2026-24524-02": {"ajax_action": "get_tables_data", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24524", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24524", "description": "Tablesome <1.2.4 missing authorization on get_tables_data AJAX handler allows low-privilege users to read all table data", "method": "GET", "mode": "block", "severity": 8.1, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.2.4"}, "RULE-CVE-2026-24524-03": {"ajax_action": "get_table_columns", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24524", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24524", "description": "Tablesome <1.2.4 missing authorization on get_table_columns AJAX handler allows low-privilege users to read table column metadata", "method": "GET", "mode": "block", "severity": 8.1, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.2.4"}, "RULE-CVE-2026-24525-01": {"action": "admin_init", "conditions": [{"name": "ARGS:clp-varnish-cache", "type": "equals", "value": "purge-entire-cache"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24525", "description": "CLP Varnish Cache <=1.0.2 unauthenticated cache purge via missing authorization on clp-varnish-cache GET parameter", "mode": "block", "severity": 5.3, "slug": "clp-varnish-cache", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-24526-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~a3blocks/product-inquiry-button[^}]*\\"(?:textAlign|width)\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|%3C|>|%3E)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24526", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24526", "description": "Stored XSS via unescaped Gutenberg block attributes (textAlign/width) in product-inquiry-button block render callback", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woocommerce-email-inquiry-cart-options", "tags": ["xss", "stored-xss", "gutenberg-block", "woocommerce"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-24526-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:editpost|edit_post)$~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24526", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24526", "description": "Stored XSS via unescaped Gutenberg block attributes (textAlign/width) in product-inquiry-button block render callback", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woocommerce-email-inquiry-cart-options", "tags": ["xss", "stored-xss", "gutenberg-block", "woocommerce"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-24529-01": {"ajax_action": "cancel", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on cancel AJAX action allows authenticated users to cancel bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-02": {"ajax_action": "confirm_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on confirm_email AJAX action allows authenticated users to confirm bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-03": {"ajax_action": "pending_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on pending_email AJAX action allows authenticated users to set bookings to pending", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-04": {"ajax_action": "reject_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on reject_email AJAX action allows authenticated users to reject bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24530-01": {"ajax_action": "webpc_remove_all_originals", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated file deletion via webpc_remove_all_originals AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-02": {"ajax_action": "webpc_remove_single", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated file deletion via webpc_remove_single AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-03": {"ajax_action": "webpc_remove_originals_selected", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated batch file deletion via webpc_remove_originals_selected AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-04": {"ajax_action": "webpc_convert_single", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated image conversion via webpc_convert_single AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-05": {"ajax_action": "webpc_convert_selected", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated batch image conversion via webpc_convert_selected AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-06": {"ajax_action": "webpc_restore_single", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated image restore via webpc_restore_single AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "file-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-07": {"ajax_action": "webpc_restore_selected", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated batch image restore via webpc_restore_selected AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "file-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-08": {"ajax_action": "update", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated settings modification via update AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24532-01": {"ajax_action": "sitelock_scan", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24532", "description": "SiteLock Security <=5.0.2 missing authorization on sitelock_scan AJAX handler allows subscribers to trigger scans", "method": "POST", "mode": "block", "severity": 4.3, "slug": "sitelock", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-24532-02": {"ajax_action": "sitelock_dismiss_notice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24532", "description": "SiteLock Security <=5.0.2 missing authorization on sitelock_dismiss_notice AJAX handler allows subscribers to dismiss admin notices", "method": "POST", "mode": "block", "severity": 4.3, "slug": "sitelock", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-24565-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=bab_Dashboard~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24565", "mode": "block", "severity": 6.5, "slug": "b-accordion", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-24572-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nelio-content/v1/posts(/|\\\\?|$)~"}, {"name": "ARGS:searchTerm", "type": "regex", "value": "~(?:\'[ \\\\t]*(?:OR|AND)[ \\\\t]+[0-9]|UNION[ \\\\t]+(?:ALL[ \\\\t]+)?SELECT|\'[ \\\\t]*(?:--|#)|SLEEP[ \\\\t]*\\\\(|BENCHMARK[ \\\\t]*\\\\()~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24572", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24572", "description": "Nelio Content <=4.2.0 authenticated (Contributor+) SQL injection via searchTerm in REST posts endpoint", "method": "GET", "mode": "block", "severity": 8.8, "slug": "nelio-content", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-24596-01": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "relpoststh_options"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|expression\\\\s*\\\\()~i"}], "cve": "CVE-2026-24596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24596", "description": "Related Posts Thumbnails <=4.3.2 CSRF to stored XSS via unsanitized plugin settings in head_style output", "method": "POST", "mode": "block", "severity": 4.7, "slug": "related-posts-thumbnails", "tags": ["csrf", "stored-xss", "settings-update"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-24616-01": {"ajax_action": "wppopups_settings_provider_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24616", "description": "WP Popups <=2.2.0.5 missing authorization on wppopups_settings_provider_add AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-popups-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.0.5"}, "RULE-CVE-2026-24616-02": {"ajax_action": "wppopups_settings_provider_disconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24616", "description": "WP Popups <=2.2.0.5 missing authorization on wppopups_settings_provider_disconnect AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-popups-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.0.5"}, "RULE-CVE-2026-24623-01": {"action": "init", "conditions": [{"name": "ARGS:forum", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 unauthenticated reflected XSS via forum parameter in shortcode rendering", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24623-02": {"action": "init", "conditions": [{"name": "ARGS:topic", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 unauthenticated reflected XSS via topic parameter in shortcode rendering", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24623-03": {"ajax_action": "neoforum_get_new_topic_form", "conditions": [{"name": "ARGS:forumid", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 authenticated reflected XSS via forumid parameter in neoforum_get_new_topic_form AJAX handler", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-01": {"ajax_action": "neoforum_close_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in close_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-02": {"ajax_action": "neoforum_restrict_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in restrict_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-03": {"ajax_action": "neoforum_delete_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in delete_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-04": {"ajax_action": "neoforum_edit_forum_title", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]|UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:^|[^a-zA-Z0-9_])(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via data in edit_forum_title AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-05": {"ajax_action": "neoforum_edit_forum_descr", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]|UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:^|[^a-zA-Z0-9_])(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via data in edit_forum_descr AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-06": {"ajax_action": "neoforum_delete_moderators", "conditions": [{"name": "ARGS:type", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via type in delete_moderators AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-07": {"ajax_action": "neoforum_add_moderators", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in add_moderators AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-08": {"ajax_action": "neoforum_topic_restore", "conditions": [{"name": "ARGS:topicid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via topicid in topic_restore AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-09": {"ajax_action": "neoforum_topic_eradicate", "conditions": [{"name": "ARGS:topicid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via topicid in topic_eradicate AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-10": {"ajax_action": "neoforum_post_restore", "conditions": [{"name": "ARGS:postid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via postid in post_restore AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-11": {"ajax_action": "neoforum_post_eradicate", "conditions": [{"name": "ARGS:postid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via postid in post_eradicate AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-12": {"ajax_action": "neoforum_report_leave_post", "conditions": [{"name": "ARGS:reportid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via reportid in report_leave_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-13": {"ajax_action": "neoforum_report_delete_post", "conditions": [{"name": "ARGS:reportid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via reportid in report_delete_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-14": {"ajax_action": "neoforum_ban_user", "conditions": [{"name": "ARGS:ban", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via ban in ban_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-15": {"ajax_action": "neoforum_unban_user", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in unban_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-16": {"ajax_action": "neoforum_make_admin", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in make_admin AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-17": {"ajax_action": "neoforum_remove_admin", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in remove_admin AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-18": {"ajax_action": "neoforum_delete_topic", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in delete_topic AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-19": {"ajax_action": "neoforum_theme_descr", "conditions": [{"name": "ARGS:theme", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/\\\\\\\\]){2,}|[\\\\/\\\\\\\\]etc[\\\\/\\\\\\\\]|wp-config\\\\.php)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated local file inclusion via theme in theme_descr AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24637-01": {"ajax_action": "powerpress_media_info", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24637", "description": "Blocks unauthenticated/low-privilege SQL injection via powerpress_media_info AJAX handler (CWE-89, Contributor+ SQLi in PowerPress <= 11.15.10). Requires edit_posts capability, mirroring the vendor patch.", "mode": "block", "severity": 8.5, "slug": "powerpress", "target": "plugin", "versions": "<=11.15.10"}, "RULE-CVE-2026-2471-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:\\\\d+:\\"[^\\"]*\\":\\\\d+:\\\\{~"}], "cve": "CVE-2026-2471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2471", "description": "WP Mail Logging <=1.15.0 unauthenticated PHP Object Injection via serialized object payload in form fields logged by wp_mail hook", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-mail-logging", "tags": ["object-injection", "deserialization", "unauthenticated", "stored-payload"], "target": "plugin", "versions": "<=1.15.0"}, "RULE-CVE-2026-2479-01": {"ajax_action": "rl_upload_image", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2479", "description": "Responsive Lightbox & Gallery <=2.7.1 SSRF via strpos()-based hostname bypass in rl_upload_image AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "responsive-lightbox", "tags": ["ssrf", "hostname-bypass", "authenticated"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-2486-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~ma_el_bh_table_btn_text[\\\\\\"\']\\\\s*:\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:<[^>]+\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|]*(?:on[a-zA-Z]+=|(?:href|src|action|formaction|data) *= *[\\"\']? *(?:javascript|data|vbscript) *:))?~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2489", "description": "TP2WP Importer <=1.1 Authenticated (Administrator+) Stored XSS via Watched Domains AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "tp2wp-importer", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-2495-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/WPNakama/v1/boards(?:[/?&]|$)~i"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(.*,|CASE\\\\s+WHEN|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2026-2495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2495", "description": "WPNakama <=0.6.5 unauthenticated SQL injection via order parameter on /WPNakama/v1/boards REST endpoint", "mode": "block", "severity": 7.5, "slug": "wpnakama", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=0.6.5"}, "RULE-CVE-2026-24950-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/authorsy/v1/authors(?:/|$|\\\\?)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24950", "description": "Authorsy <=1.0.6 unauthenticated access to REST API author endpoints leaking sensitive user data (IDOR)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "authorsy", "tags": ["missing-authorization", "idor", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-24952-01": {"ajax_action": "update_episode_embed_code", "conditions": [{"name": "ARGS:width", "type": "regex", "value": "~(?:]|]|]|]*\\\\bon[a-z]+\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-24952", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24952", "description": "Seriously Simple Podcasting <=3.14.1 authenticated XSS via width parameter in update_episode_embed_code AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "seriously-simple-podcasting", "tags": ["xss", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2026-24954-01": {"ajax_action": "mpwem_save_faq", "conditions": [{"name": "ARGS:/^mep_faq/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via mpwem_save_faq AJAX handler (question/answer fields)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-02": {"ajax_action": "mpwem_save_timeline", "conditions": [{"name": "ARGS:/^mep_timeline_details/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via mpwem_save_timeline AJAX handler (title/desc fields)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:mep_speaker_list", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_speaker_list)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-04": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:mep_event_cc_email_text", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_event_cc_email_text)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-05": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:/^mep_ev_more_date/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_ev_more_date)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24956-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpdm-elementor/v1/search-packages(/|\\\\?|&|$)~"}, {"name": "ARGS:term", "type": "regex", "value": "~(?:union(?:/[*][^*]*[*]/|[+[:space:]])+(?:all(?:/[*][^*]*[*]/|[+[:space:]])+)?select|select(?:/[*][^*]*[*]/|[+[:space:]])+.*from|(?:sleep|benchmark)[[:space:]]*[(]|waitfor(?:/[*][^*]*[*]/|[+[:space:]])+delay|load_file[[:space:]]*[(]|into(?:/[*][^*]*[*]/|[+[:space:]])+(?:outfile|dumpfile)|[\\"\'`]?[[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[0-9]+[[:space:]]*=[[:space:]]*[0-9]+|[\\"\'`]?[[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[\\"\'`][^\\"\'`]+[\\"\'`][[:space:]]*=[[:space:]]*[\\"\'`][^\\"\'`]+[\\"\'`]|[\\"\'`][[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[\\"\'`][^\\"\'`]*[\\"\'`][[:space:]]*=[[:space:]]*[\\"\'`])~i"}], "cve": "CVE-2026-24956", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24956", "description": "Download Manager Addons for Elementor <=1.3.0 blind SQL injection via term parameter in search-packages REST endpoint", "method": "GET", "mode": "block", "severity": 9.3, "slug": "wpdm-elementor", "tags": ["sql-injection", "blind-sqli", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2026-24957-01": {"ajax_action": "wpmtst_add_field", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-02": {"ajax_action": "wpmtst_add_field_2", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_2 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-03": {"ajax_action": "wpmtst_add_field_3", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_3 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-04": {"ajax_action": "wpmtst_add_field_4", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_4 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24959-01": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[0-9]+[ ]+(?:AND|OR|UNION)[ (]+~i"}], "cve": "CVE-2026-24959", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24959", "description": "JS Help Desk <=3.0.1 authenticated blind SQL injection via id parameter in jsticket_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "js-support-ticket", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-24959-02": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:status", "type": "regex", "value": "~[0-9]+[ ]+(?:AND|OR|UNION)[ (]+~i"}], "cve": "CVE-2026-24959", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24959", "description": "JS Help Desk <=3.0.1 authenticated blind SQL injection via status parameter in jsticket_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "js-support-ticket", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-24968-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_restore_mysql_backup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated arbitrary database restore via xagio_restore_mysql_backup AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated", "site-takeover"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_restore_full_backup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated arbitrary full backup restore via xagio_restore_full_backup AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated", "site-takeover"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_restore_file_backup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated arbitrary file backup restore via xagio_restore_file_backup AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated", "site-takeover"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-04": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_llms_save"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated LLM settings modification via xagio_llms_save AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-05": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_queued_groups_completed"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated project queue manipulation via xagio_queued_groups_completed AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-06": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_queued_keywords_completed"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated keyword queue manipulation via xagio_queued_keywords_completed AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-07": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_announcements"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated information disclosure via xagio_announcements AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-2498-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_admins", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_admins settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_app_id", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_app_id settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_tw_site", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_tw_site settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_type", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_type settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_tw_card", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_tw_card settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_gp_type", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_gp_type settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-24984-01": {"ajax_action": "vlp_get_post_content", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24984", "description": "Visual Link Preview <=2.2.9 missing authorization on vlp_get_post_content allows unauthorized post content disclosure", "mode": "block", "severity": 6.5, "slug": "visual-link-preview", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2026-2499-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpcl_custom_logo_path", "type": "regex", "value": "~(]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]*>~i"}], "cve": "CVE-2026-2506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2506", "description": "EM Cost Calculator <=2.3.1 unauthenticated stored XSS via customer_name in front-end order form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "cost-calculator", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-2506-02": {"action": "admin_init", "conditions": [{"name": "ARGS:cpage", "type": "exists"}, {"name": "ARGS:cpage", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>~i"}], "cve": "CVE-2026-2506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2506", "description": "EM Cost Calculator <=2.3.1 reflected XSS via cpage parameter on admin Customers page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "cost-calculator", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-2509-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?]|]|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25369", "description": "Flexmls IDX <=3.15.9 reflected XSS via unsanitized search_referral_url on listing details pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "flexmls-idx", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.15.9"}, "RULE-CVE-2026-25383-01": {"action": "init", "conditions": [{"name": "ARGS:page_url", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|details|math|marquee|isindex|form|input|button|select|textarea|keygen|frameset)\\\\b[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2026-25383", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25383", "description": "KiviCare Clinic Management System <=3.6.16 unauthenticated reflected XSS via page_url parameter in popupBookAppointment template", "mode": "block", "severity": 7.1, "slug": "kivicare-clinic-management-system", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=3.6.16"}, "RULE-CVE-2026-25396-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ccwc_hide_notice"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25396", "description": "Commerce Coinbase for WooCommerce <=1.6.7 missing authorization on ccwc_hide_notice admin-post action allows subscriber+ option update", "method": "POST", "mode": "block", "severity": 7.5, "slug": "commerce-coinbase-for-woocommerce", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-25418-01": {"ajax_action": "bitforms_get_form_entries", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_get_form_entries AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-02": {"ajax_action": "bitforms_get_form_entries", "conditions": [{"name": "ARGS:offset", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via offset parameter in bitforms_get_form_entries AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-03": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via orderBy parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-04": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via order parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-05": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-06": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via orderBy parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-07": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via order parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-08": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:fields", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via fields parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-09": {"ajax_action": "bitforms_form_log_history", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_form_log_history AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-10": {"ajax_action": "bitforms_form_log_history", "conditions": [{"name": "ARGS:offset", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via offset parameter in bitforms_form_log_history AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-11": {"ajax_action": "bitforms_entry_status_update", "conditions": [{"name": "ARGS:entryID", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via entryID parameter in bitforms_entry_status_update AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25429-01": {"ajax_action": "nexa_load_more_posts", "conditions": [{"name": "ARGS:attributes", "type": "regex", "value": "~(?:[OC]:[0-9]+:[\\"\\\\{]|(?:Tzo|Qzo)[0-9A-Za-z+/]*[=]{0,2})~"}], "cve": "CVE-2026-25429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25429", "description": "Nexa Blocks <=1.1.1 unauthenticated PHP object injection via base64-encoded attributes parameter in nexa_load_more_posts AJAX handler", "mode": "block", "severity": 9.8, "slug": "nexa-blocks", "tags": ["object-injection", "deserialization", "unauthenticated", "php-object-injection"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-25430-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^log_detail_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing authorization on log_detail AJAX action allows subscriber+ to read CRM logs and trigger reflected XSS", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25430-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^review_dismiss_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing authorization on review_dismiss AJAX action allows subscriber+ to toggle admin notice state", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25430-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^get_objects_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing capability check on get_objects AJAX action allows subscriber+ to enumerate CRM objects", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25435-01": {"ajax_action": "wpdevart_ajax", "conditions": [{"name": "ARGS:wpdevart_id", "type": "regex", "value": "~(?:]|]|]|]|]|]|]|]|]|]|]|]|]|]|]|=2.0.0 <=2.3.9"}, "RULE-CVE-2026-25447-02": {"ajax_action": "ww_form_ajax", "conditions": [{"name": "ARGS:context", "type": "regex", "value": "~(\\\\beval\\\\b|\\\\bsystem\\\\b|shell_exec|\\\\bexec\\\\b|base64_decode|passthru|popen|proc_open|call_user_func|create_function|O:[0-9]+:|<\\\\?php)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-25447", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25447", "description": "Widget Wrangler <=2.3.9 code injection via context in ww_form_ajax AJAX handler", "mode": "block", "severity": 9.1, "slug": "widget-wrangler", "tags": ["code-injection", "rce", "authenticated"], "target": "plugin", "versions": ">=2.0.0 <=2.3.9"}, "RULE-CVE-2026-25452-01": {"action": "init", "conditions": [{"name": "ARGS:remoji_id", "type": "regex", "value": "~(?:\\\\b(?:AND|OR)\\\\b(?:/\\\\*.*?\\\\*/|\\\\s|[\'\\"`()0-9]){0,32}(?:\\\\d+|[\'\\"][^\'\\"]*[\'\\"])[[:space:]]*=[[:space:]]*(?:\\\\d+|[\'\\"][^\'\\"]*[\'\\"])|\\\\bUN(?:/\\\\*.*?\\\\*/|\\\\s)*ION\\\\b(?:/\\\\*.*?\\\\*/|\\\\s)+(?:ALL(?:/\\\\*.*?\\\\*/|\\\\s)+)?SELECT\\\\b|/\\\\*.*?\\\\*/|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\b|--\\\\s*[^\\\\r\\\\n]*)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated SQL injection via remoji_id parameter in Reaction::_del", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["sql-injection", "unauthenticated", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25452-02": {"action": "init", "conditions": [{"name": "ARGS:remoji_id", "type": "regex", "value": "~(?:]|][^>]*onload\\\\s*=|][^>]*onerror\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated stored XSS via remoji_id parameter", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["xss", "stored", "unauthenticated", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25452-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/remoji/v1/add(?:/|\\\\?|$)~"}, {"name": "ARGS:emoji", "type": "regex", "value": "~(?:]|][^>]*onload\\\\s*=|][^>]*onerror\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated stored XSS via emoji parameter on Remoji REST add route", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["xss", "stored", "unauthenticated", "rest-api", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25456-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/shipi/v1/connect/fedex/?(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25456", "description": "Automated FedEx Shipping <=5.1.8 unauthenticated access to transient nonce data via shipi/v1/connect/fedex REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "a2z-fedex-shipping", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-25471-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:tpsa_verify_email_otp", "type": "exists"}], "cve": "CVE-2026-25471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25471", "description": "Admin Safety Guard <=1.2.6 broken authentication via OTP submission on wp-login.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "admin-safety-guard", "tags": ["authentication-bypass", "broken-authentication", "unauthenticated", "otp-bypass"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2026-25471-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:tpsa_verify_email_otp", "type": "regex", "value": "~(?:]*>|]*onerror[[:space:]]*=|on(?:error|load|mouseover|click)[[:space:]]*=|javascript:)~i"}], "cve": "CVE-2026-25471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25471", "description": "Admin Safety Guard <=1.2.6 reflected XSS via unsanitized tpsa_verify_email_otp on wp-login.php", "method": "GET", "mode": "block", "severity": 8.1, "slug": "admin-safety-guard", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2026-2554-01": {"ajax_action": "delete_wcfm_customer", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2554", "description": "WCFM <=6.7.25 IDOR allowing authenticated Vendor+ to delete arbitrary users via customerid parameter", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "authorization-bypass", "privilege-escalation"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-2568-01": {"action": "admin_init", "conditions": [{"name": "ARGS:entry_id", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via entry_id parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-02": {"action": "admin_init", "conditions": [{"name": "ARGS:start_date", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via start_date parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-03": {"action": "admin_init", "conditions": [{"name": "ARGS:end_date", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via end_date parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-04": {"action": "admin_init", "conditions": [{"name": "ARGS:vx_debug", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via vx_debug parameter on admin entry box page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2571-01": {"ajax_action": "wpdmdz_user_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2571", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2571", "description": "Download Manager <=3.3.49 missing authorization on wpdmdz_user_status AJAX handler allows subscriber+ user enumeration", "mode": "block", "severity": 4.3, "slug": "download-manager", "tags": ["missing-authorization", "information-disclosure", "idor"], "target": "plugin", "versions": "<=3.3.49"}, "RULE-CVE-2026-2576-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment", "type": "detectSQLi"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment parameter (scalar)", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2576-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment[0]", "type": "regex", "value": "~(?:\'|\\"|;|--|#|/\\\\*|\\\\bOR\\\\b|\\\\bAND\\\\b|\\\\bUNION\\\\b|\\\\bSELECT\\\\b|\\\\bSLEEP\\\\b|\\\\bBENCHMARK\\\\b)~i"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment[] array parameter", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2576-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment[1]", "type": "regex", "value": "~(?:\'|\\"|;|--|#|/\\\\*|\\\\bOR\\\\b|\\\\bAND\\\\b|\\\\bUNION\\\\b|\\\\bSELECT\\\\b|\\\\bSLEEP\\\\b|\\\\bBENCHMARK\\\\b)~i"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment[] array parameter (index 1)", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2579-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wopb/product-search(/|\\\\?|$)~"}, {"name": "ARGS:search", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2026-2579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2579", "description": "ProductX/WowStore <=4.4.3 unauthenticated SQL injection via search parameter in wopb/product-search REST endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "product-blocks", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.4.3"}, "RULE-CVE-2026-2580-01": {"ajax_action": "wpgmp_ajax_call", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-2580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2580", "description": "WP Google Map Plugin <=4.9.1 authenticated SQL injection via orderby parameter", "mode": "block", "severity": 7.5, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=4.9.1"}, "RULE-CVE-2026-2582-01": {"ajax_action": "show_direct_debit", "conditions": [{"name": "ARGS:account_holder", "type": "regex", "value": "~\\\\[\\\\s*[a-z_][a-z0-9_]{2,}[\\\\s\\\\]\\\\/]~"}], "cve": "CVE-2026-2582", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2582", "description": "Germanized for WooCommerce <=3.20.5 unauthenticated arbitrary shortcode execution via account_holder parameter in direct debit mandate AJAX handler", "mode": "block", "severity": 6.5, "slug": "woocommerce-germanized", "tags": ["code-injection", "shortcode-execution", "unauthenticated"], "target": "plugin", "versions": "<=3.20.5"}, "RULE-CVE-2026-2583-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:meta[blocksy_meta]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:img|svg|iframe|object|embed|details|video|audio|math|body|input|button|select|textarea|form|marquee|a|div|p|table|style)\\\\b[^>]*\\\\bon(?:error|load|mouseover|click|focus|blur|animationend|toggle|resize|pointerover|auxclick)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[\\\\s/>])~i"}], "cve": "CVE-2026-2583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2583", "description": "Blocksy <=2.1.30 Contributor+ stored XSS via blocksy_meta in REST API post creation/update", "mode": "block", "severity": 6.4, "slug": "blocksy", "tags": ["xss", "stored", "authenticated"], "target": "theme", "versions": "<=2.1.30"}, "RULE-CVE-2026-2583-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:blocksy_meta", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:img|svg|iframe|object|embed|details|video|audio|math|body|input|button|select|textarea|form|marquee|a|div|p|table|style)\\\\b[^>]*\\\\bon(?:error|load|mouseover|click|focus|blur|animationend|toggle|resize|pointerover|auxclick)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[\\\\s/>])~i"}], "cve": "CVE-2026-2583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2583", "description": "Blocksy <=2.1.30 Contributor+ stored XSS via blocksy_meta in classic post editor", "mode": "block", "severity": 6.4, "slug": "blocksy", "tags": ["xss", "stored", "authenticated"], "target": "theme", "versions": "<=2.1.30"}, "RULE-CVE-2026-25863-01": {"ajax_action": "cf7mls_validation", "conditions": [{"name": "ARGS:_count", "type": "regex", "value": "~^\\\\d{4,}$~"}], "cve": "CVE-2026-25863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25863", "description": "Contact Form 7 Conditional Fields <=2.7.3 unauthenticated denial of service via repeater _count parameter", "method": "POST", "mode": "block", "severity": 7.5, "slug": "cf7-conditional-fields", "tags": ["denial-of-service", "resource-consumption", "unauthenticated"], "target": "plugin", "versions": "<=2.7.3"}, "RULE-CVE-2026-2589-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-content/plugins/greenshift-animation-and-page-builder-blocks/).*(?:backup|settings_backup).*\\\\.(?:json|txt|zip)(?:\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2589", "description": "GreenShift <= 12.8.3 unauthenticated sensitive information exposure via settings backup file in plugin directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=12.8.3"}, "RULE-CVE-2026-2589-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-content/uploads/greenshift/).*(?:backup|settings_backup).*\\\\.(?:json|txt|zip)(?:\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2589", "description": "GreenShift <= 12.8.3 unauthenticated sensitive information exposure via settings backup file in uploads directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=12.8.3"}, "RULE-CVE-2026-2592-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "equals", "value": "wc_zpal"}, {"name": "ARGS:Status", "type": "equals", "value": "OK"}, {"name": "ARGS:wc_order", "type": "exists"}, {"name": "ARGS:Authority", "type": "regex", "value": "~^[A-Za-z0-9]{16,35}$~"}], "cve": "CVE-2026-2592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2592", "description": "ZarinPal WooCommerce Payment Gateway <=5.0.16 improper access control via wc-api wc_zpal callback with forged short Authority token", "mode": "block", "severity": 7.7, "slug": "zarinpal-woocommerce-payment-gateway", "tags": ["improper-access-control", "payment-bypass", "woocommerce-api", "unauthenticated"], "target": "plugin", "versions": "<=5.0.16"}, "RULE-CVE-2026-2593-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:meta[_gspb_post_css]", "type": "regex", "value": "~]~i"}], "cve": "CVE-2026-2593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2593", "description": "GreenShift <=12.8.5 Stored XSS via _gspb_post_css post meta through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=12.8.5"}, "RULE-CVE-2026-2593-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~greenshift-blocks/element[^}]*dynamicAttributes[^}]*<[a-zA-Z][a-zA-Z0-9]*[ /][^>]*(?:on[a-zA-Z]+=|javascript:|]~i"}], "cve": "CVE-2026-2593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2593", "description": "GreenShift <=12.8.5 Stored XSS via _gspb_post_css meta through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "classic-editor"], "target": "plugin", "versions": "<=12.8.5"}, "RULE-CVE-2026-2599-01": {"action": "init", "conditions": [{"name": "ARGS:vx_crm_form_action", "type": "equals", "value": "download_csv"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2599", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2599", "description": "Contact Form Entries <=1.4.7 unauthenticated PHP Object Injection via download_csv deserialization trigger", "method": "GET", "mode": "block", "severity": 9.8, "slug": "contact-form-entries", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.4.7"}, "RULE-CVE-2026-2628-01": {"action": "init", "conditions": [{"name": "ARGS:id_token", "type": "regex", "value": "~^[A-Za-z0-9_=-]+\\\\.[A-Za-z0-9_=-]+\\\\.?[A-Za-z0-9_=-]*$~"}, {"name": "ARGS:code", "type": "exists"}], "cve": "CVE-2026-2628", "method": "GET", "mode": "block", "severity": 9.8, "slug": "login-with-azure", "target": "plugin", "versions": "<2.2.6"}, "RULE-CVE-2026-2631-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/datalogics/v1/(?:token|update)(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[^a-z0-9_])(?:users_can_register|default_role|siteurl|admin_email)(?:[^a-z0-9_]|$)~i"}], "cve": "CVE-2026-2631", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2631", "description": "Datalogics <=2.6.59 arbitrary WordPress option update via Datalogics REST namespace", "method": "POST", "mode": "block", "severity": 9.8, "slug": "datalogics", "tags": ["privilege-escalation", "arbitrary-option-update", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.6.59"}, "RULE-CVE-2026-27044-01": {"ajax_action": "totalpoll_modules_install_from_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-27044", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27044", "description": "Total Poll Lite <=4.12.0 authenticated remote code execution via totalpoll_modules_install_from_file AJAX handler", "mode": "block", "severity": 9.9, "slug": "totalpoll-lite", "tags": ["remote-code-execution", "code-injection", "missing-authorization"], "target": "plugin", "versions": "<=4.12.0"}, "RULE-CVE-2026-27053-01": {"ajax_action": "vwls_stream_setup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via vwls_stream_setup AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27053-02": {"ajax_action": "h5vls_app", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via h5vls_app AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27053-03": {"ajax_action": "vwls_stream", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via vwls_stream AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27067-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprne/v1/media/insert_media(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2026-27067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27067", "description": "Mobile App Editor <=1.3.1 arbitrary file upload via /wprne/v1/media/insert_media REST endpoint", "method": "POST", "mode": "block", "severity": 9.1, "slug": "mobile-app-editor", "tags": ["arbitrary-file-upload", "web-shell", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-27067-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprne/v1/media/insert_font(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2026-27067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27067", "description": "Mobile App Editor <=1.3.1 arbitrary file upload via /wprne/v1/media/insert_font REST endpoint", "method": "POST", "mode": "block", "severity": 9.1, "slug": "mobile-app-editor", "tags": ["arbitrary-file-upload", "web-shell", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-27068-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:llms_generator_settings", "type": "regex", "value": "~(?:]*>||javascript\\\\s*:|on[a-z]+\\\\s*=|]*>|]*>)~i"}], "cve": "CVE-2026-27068", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27068", "description": "Website LLMs.txt <=8.2.6 reflected XSS via llms_generator_settings reflected in admin/admin-page.php hidden input attributes", "mode": "block", "severity": 7.1, "slug": "website-llms-txt", "tags": ["xss", "reflected-xss", "admin-page", "crafted-link"], "target": "plugin", "versions": "<=8.2.6"}, "RULE-CVE-2026-2707-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/weforms/v1/forms/[0-9]+/entries(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~]*>|on(error|load|click|mouseover|focus|blur) *=~i"}], "cve": "CVE-2026-2707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2707", "description": "weForms <=1.6.27 authenticated stored XSS via form entry field values submitted through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "weforms", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2026-2707-02": {"ajax_action": "weforms_frontend_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(error|load|click|mouseover|focus|blur) *=~i"}], "cve": "CVE-2026-2707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2707", "description": "weForms <=1.6.27 authenticated stored XSS via form entry field values submitted through AJAX frontend submit", "method": "POST", "mode": "block", "severity": 6.4, "slug": "weforms", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2026-27071-01": {"ajax_action": "save_location", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-27071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27071", "description": "WPCafe <=3.0.6 unauthenticated broken access control on save_location AJAX handler", "mode": "block", "severity": 9.1, "slug": "wp-cafe", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.0.6"}, "RULE-CVE-2026-27072-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:pys_head", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27072", "description": "PixelYourSite <=11.2.0.1 Stored XSS via pys_head parameter in HeadFooter save_meta_box", "method": "POST", "mode": "block", "severity": 7.1, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "post-meta"], "target": "plugin", "versions": "<=11.2.0.1"}, "RULE-CVE-2026-27072-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:pys_footer", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27072", "description": "PixelYourSite <=11.2.0.1 Stored XSS via pys_footer parameter in HeadFooter save_meta_box", "method": "POST", "mode": "block", "severity": 7.1, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "post-meta"], "target": "plugin", "versions": "<=11.2.0.1"}, "RULE-CVE-2026-27075-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27075", "description": "belfort theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "belfort", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27075-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27075", "description": "belfort theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "belfort", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27076-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27076", "description": "luxedrive theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "luxedrive", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27076-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27076", "description": "luxedrive theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "luxedrive", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27077-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27077", "description": "multioffice theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "multioffice", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27077-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27077", "description": "multioffice theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "multioffice", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27078-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27078", "description": "emaurri theme <= 1.0.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "emaurri", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-27078-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27078", "description": "emaurri theme <= 1.0.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "emaurri", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-27079-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27079", "description": "amfissa theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "amfissa", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-27079-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27079", "description": "amfissa theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "amfissa", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-27080-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27080", "description": "deston theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "deston", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27080-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27080", "description": "deston theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "deston", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27081-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27081", "description": "rosebud theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rosebud", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2026-27081-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27081", "description": "rosebud theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rosebud", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2026-27082-01": {"ajax_action": "lovestory_options_import", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|%25(?:4[fF]|4[fF])%25(?:3[aA]|3[aA])|%4[fF]%3[aA])O(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\"|%22|%2522)[^\\"]+(?:\\"|%22|%2522)(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\\\{|%7[Bb]|%257[Bb])~"}], "cve": "CVE-2026-27082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27082", "description": "Love Story <=1.3.12 PHP object injection via lovestory_options_import AJAX data parameter", "mode": "block", "severity": 9.8, "slug": "lovestory", "tags": ["object-injection", "deserialization", "authenticated", "ajax"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2026-27082-02": {"ajax_action": "lovestory_options_save", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|%25(?:4[fF]|4[fF])%25(?:3[aA]|3[aA])|%4[fF]%3[aA])O(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\"|%22|%2522)[^\\"]+(?:\\"|%22|%2522)(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\\\{|%7[Bb]|%257[Bb])~"}], "cve": "CVE-2026-27082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27082", "description": "Love Story <=1.3.12 PHP object injection via lovestory_options_save AJAX data parameter", "mode": "block", "severity": 9.8, "slug": "lovestory", "tags": ["object-injection", "deserialization", "authenticated", "ajax"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2026-27094-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:coblocks/[a-z-]+\\\\s*\\\\{[^}]*(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|toggle|pointer\\\\w+)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27094", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27094", "description": "CoBlocks <=3.1.16 Contributor+ stored XSS via CoBlocks block attributes in post content", "mode": "block", "severity": 6.5, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-27095-04": {"ajax_action": "get_wbtm_return_date", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via get_wbtm_return_date AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-05": {"ajax_action": "get_wbtm_dropping_point", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via get_wbtm_dropping_point AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-06": {"ajax_action": "wbtm_create_seat_plan", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_create_seat_plan AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-07": {"ajax_action": "wbtm_create_seat_plan_dd", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_create_seat_plan_dd AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-08": {"ajax_action": "wbtm_get_bus_detail", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_get_bus_detail AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-09": {"ajax_action": "wbtm_reload_pricing", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_reload_pricing AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27097-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27097", "description": "casamia theme <= 1.1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "casamia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-27097-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27097", "description": "casamia theme <= 1.1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "casamia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-2712-01": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS:data[wp-optimize-heartbeat-smush][command]", "type": "regex", "value": "~^(?:get_smush_logs|clean_all_backup_images|process_bulk_smush|update_smush_options|get_smush_options|clear_smush_stats|clear_backup_images|clear_backup_images_directory|delete_log_files|get_logfile_path)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2712", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2712", "description": "WP-Optimize <=4.5.0 missing authorization in receive_heartbeat() allows subscriber+ to invoke admin-only Smush commands via Heartbeat API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-optimize", "tags": ["incorrect-authorization", "missing-capability", "heartbeat-abuse"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2718-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:dealia/"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:dealia/[^}]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2718", "description": "Dealia - Request a Quote <=1.0.8 Contributor+ stored XSS via Gutenberg block attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dealia-request-a-quote", "tags": ["xss", "stored", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-2718-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:dealia/"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:dealia/[^}]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2718", "description": "Dealia - Request a Quote <=1.0.8 Contributor+ stored XSS via Gutenberg block attributes in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dealia-request-a-quote", "tags": ["xss", "stored", "gutenberg-block", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-2720-01": {"ajax_action": "hrp-fetch-employees", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2720", "description": "HR Press Lite <=1.0.2 missing authorization on hrp-fetch-employees AJAX action allows subscriber+ sensitive employee data exposure", "mode": "block", "severity": 6.5, "slug": "hr-press-lite", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-2721-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:mailarchiver_archiver_privacy_encryption", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|focus|blur|click)\\\\s*=|javascript\\\\s*:|)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2721", "description": "MailArchiver <=4.4.0 authenticated stored XSS via mailarchiver_archiver_privacy_encryption settings field", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mailarchiver", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=4.4.0"}, "RULE-CVE-2026-2724-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "unitecreator_ajax_action"}, {"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2026-2724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2724", "description": "Unlimited Elements for Elementor <=2.0.5 unauthenticated stored XSS via form field values", "method": "POST", "mode": "block", "severity": 7.2, "slug": "unlimited-elements-for-elementor", "tags": ["xss", "stored-xss", "unauthenticated", "elementor"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-2732-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "emr_prepare_remove_background"}, {"name": "ARGS:attachment_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2732", "description": "Enable Media Replace <=4.1.7 missing authorization on Remove Background GET handler allows Author+ to access arbitrary attachments", "method": "GET", "mode": "block", "severity": 5.4, "slug": "enable-media-replace", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=4.1.7"}, "RULE-CVE-2026-2732-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "emr_process_remove_background"}, {"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2732", "description": "Enable Media Replace <=4.1.7 missing authorization on Remove Background POST handler allows Author+ to replace arbitrary attachments", "method": "POST", "mode": "block", "severity": 5.4, "slug": "enable-media-replace", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=4.1.7"}, "RULE-CVE-2026-27326-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27326", "description": "window-ac-services theme <= 1.2.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "window-ac-services", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.5"}, "RULE-CVE-2026-27326-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27326", "description": "window-ac-services theme <= 1.2.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "window-ac-services", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.5"}, "RULE-CVE-2026-27333-01": {"ajax_action": "vmls_app", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:Tzo|bzo|YTo)[A-Za-z0-9+/=%\\\\s]~i"}], "cve": "CVE-2026-27333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27333", "description": "PPV Live Webcams <=7.3.23 unauthenticated PHP object injection via vmls_app AJAX handler deserialization of base64-encoded data parameter", "mode": "block", "severity": 8.1, "slug": "ppv-live-webcams", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=7.3.23"}, "RULE-CVE-2026-27333-02": {"ajax_action": "vmls", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:Tzo|bzo|YTo)[A-Za-z0-9+/=%\\\\s]~i"}], "cve": "CVE-2026-27333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27333", "description": "PPV Live Webcams <=7.3.23 unauthenticated PHP object injection via vmls AJAX handler deserialization of base64-encoded data parameter", "mode": "block", "severity": 8.1, "slug": "ppv-live-webcams", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=7.3.23"}, "RULE-CVE-2026-27335-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27335", "description": "ekoterra theme <= 1.0.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ekoterra", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-27335-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27335", "description": "ekoterra theme <= 1.0.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ekoterra", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-27336-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27336", "description": "consultor theme <= 1.2.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "consultor", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.4"}, "RULE-CVE-2026-27336-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27336", "description": "consultor theme <= 1.2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "consultor", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.4"}, "RULE-CVE-2026-27337-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27337", "description": "chronicle theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "chronicle", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27337-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27337", "description": "chronicle theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "chronicle", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27339-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27339", "description": "buzzstone theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "buzzstone", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-27339-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27339", "description": "buzzstone theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "buzzstone", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-27340-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27340", "description": "apollo theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "apollo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-27340-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27340", "description": "apollo theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "apollo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-27341-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27341", "description": "topscorer theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "topscorer", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27341-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27341", "description": "topscorer theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "topscorer", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27342-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27342", "description": "topfit theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "topfit", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-27342-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27342", "description": "topfit theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "topfit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-27353-01": {"ajax_action": "grandnews_ppb", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-27353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27353", "description": "Grand News Theme <=3.4.3 unauthenticated reflected XSS via shortcode parameter", "method": "POST", "mode": "block", "severity": 7.1, "slug": "grandnews", "tags": ["xss", "reflected", "unauthenticated"], "target": "theme", "versions": "<=3.4.3"}, "RULE-CVE-2026-27353-02": {"ajax_action": "grandnews_ppb", "conditions": [{"name": "ARGS:rel", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-27353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27353", "description": "Grand News Theme <=3.4.3 unauthenticated reflected XSS via rel parameter", "method": "POST", "mode": "block", "severity": 7.1, "slug": "grandnews", "tags": ["xss", "reflected", "unauthenticated"], "target": "theme", "versions": "<=3.4.3"}, "RULE-CVE-2026-27366-01": {"action": "init", "conditions": [{"name": "ARGS:mainwpsignature", "type": "exists"}, {"name": "ARGS:register", "type": "exists"}], "cve": "CVE-2026-27366", "description": "MainWP Child <=6.1.1 unauthenticated broken access control via site registration flow", "mode": "block", "severity": 7.5, "slug": "mainwp-child", "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-27369-01": {"ajax_action": "bt_bb_get_grid_portfolio", "conditions": [{"name": "ARGS:show", "type": "regex", "value": "~^[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2026-27369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27369", "description": "Celeste Theme <=1.3.6 unauthenticated PHP object injection via show parameter in bt_bb_get_grid_portfolio AJAX handler", "mode": "block", "severity": 8.1, "slug": "celeste", "tags": ["object-injection", "php-deserialization", "unauthenticated"], "target": "theme", "versions": "<=1.3.6"}, "RULE-CVE-2026-27379-01": {"ajax_action": "nxs_saveSiteSets", "conditions": [{"name": "ARGS:fltrs", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27379", "description": "NextScripts SNAP <=4.4.7 PHP Object Injection via unserialize of fltrs parameter in nxs_saveSiteSets AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.4.7"}, "RULE-CVE-2026-27379-02": {"ajax_action": "nxs_snap_aj", "conditions": [{"name": "ARGS:fltrs", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27379", "description": "NextScripts SNAP <=4.4.7 PHP Object Injection via unserialize of fltrs parameter in nxs_snap_aj AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.4.7"}, "RULE-CVE-2026-27384-01": {"ajax_action": "w3tc_dismiss_license_notice", "conditions": [{"name": "ARGS:notice_id", "type": "detectSQLi"}], "cve": "CVE-2026-27384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27384", "description": "W3 Total Cache <=2.9.1 authenticated SQL injection via notice_id in w3tc_dismiss_license_notice AJAX handler", "method": "POST", "mode": "block", "severity": 9.0, "slug": "w3-total-cache", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.9.1"}, "RULE-CVE-2026-27410-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27410", "description": "Slimstat Analytics <5.4.0 unauthenticated PHP object injection via slimtrack AJAX tracker endpoint", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<5.4.0"}, "RULE-CVE-2026-27410-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/slimstat/v1/hit(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27410", "description": "Slimstat Analytics <5.4.0 unauthenticated PHP object injection via REST slimstat/v1/hit endpoint", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<5.4.0"}, "RULE-CVE-2026-27421-01": {"ajax_action": "count_compare_items", "conditions": [{"name": "ARGS:compare_empty_text", "type": "regex", "value": "~(?:]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via count_compare_items \\u2013 blocks unauthenticated/low-priv requests containing XSS payloads in compare_empty_text echoed without escaping in includes/compare.php:621", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27421-02": {"ajax_action": "wpr_woo_grid_filters_ajax", "conditions": [{"name": "ARGS:grid_settings[/\\\\w+/]", "type": "regex", "value": "~(?:]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via wpr_woo_grid_filters_ajax \\u2013 blocks unauthenticated requests injecting XSS in grid_settings array values rendered without escaping in wpr-templates-data.php", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27421-03": {"ajax_action": "wpr_load_more_tweets", "conditions": [{"name": "ARGS:wpr_load_more_settings[/\\\\w+/]", "type": "regex", "value": "~(?:]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via wpr_load_more_tweets \\u2013 blocks unauthenticated requests injecting XSS in wpr_load_more_settings array values rendered without escaping in wpr-load-more-tweets.php", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27984-01": {"ajax_action": "widgetopts_ajax_validate_expression", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:system|passthru|exec|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace|create_function|call_user_func|call_user_func_array|file_get_contents|file_put_contents|fopen|fwrite|include|require|phpinfo|unlink|rmdir|mail|header|curl_exec|base64_decode)[ ]*[(]~i"}], "cve": "CVE-2026-27984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27984", "description": "Widget Options <=4.1.3 authenticated code injection via widgetopts_ajax_validate_expression AJAX handler", "method": "POST", "mode": "block", "severity": 9.0, "slug": "widget-options", "tags": ["code-injection", "rce", "authenticated"], "target": "plugin", "versions": "<=4.1.3"}, "RULE-CVE-2026-27986-01": {"ajax_action": "ostende_ajax_get_posts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|zip|phar)://|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-27986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27986", "description": "OsTende theme <=1.4.3 unauthenticated LFI via ostende_ajax_get_posts AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "ostende", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "php-file-inclusion"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2026-27986-02": {"ajax_action": "ostende_get_linked_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|zip|phar)://|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-27986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27986", "description": "OsTende theme <=1.4.3 unauthenticated LFI via ostende_get_linked_data AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "ostende", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "php-file-inclusion"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2026-27988-01": {"ajax_action": "equadio_ajax_get_posts", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_ajax_get_posts slug parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-02": {"ajax_action": "equadio_ajax_get_posts", "conditions": [{"name": "ARGS:part", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_ajax_get_posts part parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-03": {"ajax_action": "equadio_download_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_download_skin skin parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-04": {"ajax_action": "equadio_download_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_download_skin file parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-05": {"ajax_action": "equadio_switch_skin", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_switch_skin slug parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-06": {"ajax_action": "equadio_switch_skin", "conditions": [{"name": "ARGS:part", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_switch_skin part parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27989-01": {"ajax_action": "quanzo_switch_skin", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|(?:^|/)(?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|file|phar)://)~i"}, {"type": "missing_capability", "value": "edit_themes"}], "cve": "CVE-2026-27989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27989", "description": "Quanzo Theme <=1.0.10 local file inclusion via quanzo_switch_skin AJAX handler", "mode": "block", "severity": 8.1, "slug": "quanzo", "tags": ["local-file-inclusion", "path-traversal", "missing-authorization"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-27989-02": {"ajax_action": "quanzo_download_skin", "conditions": [{"name": "ARGS:skin_url", "type": "regex", "value": "~^(?!https?://[\\\\w.-]+(?:/[\\\\w. -]*)?\\\\.zip$).+~i"}, {"type": "missing_capability", "value": "edit_themes"}], "cve": "CVE-2026-27989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27989", "description": "Quanzo Theme <=1.0.10 remote/local file inclusion via quanzo_download_skin AJAX handler", "mode": "block", "severity": 8.1, "slug": "quanzo", "tags": ["local-file-inclusion", "remote-file-inclusion", "missing-authorization"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-27989-03": {"ajax_action": "quanzo_buy_skin", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|(?:^|/)(?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|file|phar)://)~i"}, {"type": "missing_capability", "value": "edit_themes"}], "cve": "CVE-2026-27989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27989", "description": "Quanzo Theme <=1.0.10 local file inclusion via quanzo_buy_skin AJAX handler", "mode": "block", "severity": 8.1, "slug": "quanzo", "tags": ["local-file-inclusion", "path-traversal", "missing-authorization"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-27989-04": {"ajax_action": "quanzo_update_skin", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|(?:^|/)(?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|file|phar)://)~i"}, {"type": "missing_capability", "value": "edit_themes"}], "cve": "CVE-2026-27989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27989", "description": "Quanzo Theme <=1.0.10 local file inclusion via quanzo_update_skin AJAX handler", "mode": "block", "severity": 8.1, "slug": "quanzo", "tags": ["local-file-inclusion", "path-traversal", "missing-authorization"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-28015-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|file|phar|expect|zip|data)://)~i"}], "cve": "CVE-2026-28015", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28015", "description": "ShiftCV Theme <=3.0.14 unauthenticated LFI via path traversal in layout/skin/template parameters (fixed during pagination in 3.0.15)", "mode": "block", "severity": 8.1, "slug": "shift-cv", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=3.0.14"}, "RULE-CVE-2026-28024-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28024", "description": "helion theme <= 1.1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "helion", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2026-28024-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28024", "description": "helion theme <= 1.1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "helion", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2026-28030-01": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-02": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (file param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-03": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:skin_url", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (skin_url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-04": {"ajax_action": "bonbon_switch_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_switch_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-05": {"ajax_action": "bonbon_switch_skin", "conditions": [{"name": "ARGS:theme", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_switch_skin AJAX handler (theme param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-06": {"ajax_action": "bonbon_buy_skin", "conditions": [{"name": "ARGS:product_id", "type": "regex", "value": "~(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_buy_skin AJAX handler (product_id param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-07": {"ajax_action": "bonbon_buy_skin", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_buy_skin AJAX handler (url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-08": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-09": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (file param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-10": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:skin_url", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (skin_url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28039-01": {"ajax_action": "wpdatatables_save_table_config", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via table config language/column type setting (require_once with unsanitized path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-02": {"ajax_action": "wpdatatables_save_plugin_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via plugin settings language parameter (require_once with unsanitized wdtInterfaceLanguage)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-03": {"ajax_action": "wpdatatable_save_chart_get_shortcode", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via chart engine parameter (require_once with unsanitized engine value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-04": {"ajax_action": "wpdatatable_show_chart_from_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via chart show engine parameter (require_once with unsanitized engine value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-05": {"ajax_action": "wdtable_update_cache", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:file://|php://|phar://|expect://|data://|glob://|zip://|compress\\\\.)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 unauthenticated SSRF/LFI via cache update file_get_contents with unrestricted URL scheme", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "ssrf", "unauthenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-06": {"ajax_action": "wpdatatables_get_nested_json_roots", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env|file://|php://|phar://|expect://|data://|glob://|zip://|compress\\\\.)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 SSRF/LFI via nested JSON roots file_get_contents with unrestricted URL scheme", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "ssrf", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28041-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28041", "description": "grit theme <= 1.0.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "grit", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-28041-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28041", "description": "grit theme <= 1.0.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "grit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-28043-01": {"ajax_action": "healer_ajax_get_posts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|data|expect|zip|phar)://|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|/proc/self)|\\\\.\\\\. %25(?:2[Ff]|5[Cc]))~i"}], "cve": "CVE-2026-28043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28043", "description": "Healer theme <=1.0.0 unauthenticated local file inclusion via healer_ajax_get_posts AJAX handler", "mode": "block", "severity": 9.8, "slug": "healer", "tags": ["local-file-inclusion", "unauthenticated", "path-traversal", "php-stream-wrapper"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-28048-01": {"action": "init", "conditions": [{"name": "ARGS:flashtemplate", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28048", "description": "FlashMart Theme <=2.0.15 unauthenticated local file inclusion via template parameter", "mode": "block", "severity": 8.1, "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "core", "versions": ">=5.0"}, "RULE-CVE-2026-28049-01": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via template parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-02": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via page parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-03": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via file parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-04": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:include", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via include parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28060-01": {"ajax_action": "stephanie_king_get_linked_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)|[A-Za-z]:\\\\\\\\)~i"}], "cve": "CVE-2026-28060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28060", "description": "S.King <=1.5.3 unauthenticated local file inclusion via stephanie_king_get_linked_data AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "stephanie-king", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "ajax"], "target": "theme", "versions": "<=1.5.3"}, "RULE-CVE-2026-28060-02": {"ajax_action": "stephanie_king_ajax_get_posts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)|[A-Za-z]:\\\\\\\\)~i"}], "cve": "CVE-2026-28060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28060", "description": "S.King <=1.5.3 unauthenticated local file inclusion via stephanie_king_ajax_get_posts AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "stephanie-king", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "ajax"], "target": "theme", "versions": "<=1.5.3"}, "RULE-CVE-2026-28065-01": {"action": "init", "conditions": [{"name": "ARGS:section", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28065", "description": "Eject Theme <=2.17 unauthenticated local file inclusion via section param", "method": "GET", "mode": "block", "severity": 8.1, "slug": "eject", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28065-02": {"action": "init", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28065", "description": "Eject Theme <=2.17 unauthenticated local file inclusion via template param", "method": "GET", "mode": "block", "severity": 8.1, "slug": "eject", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28065-03": {"action": "init", "conditions": [{"name": "ARGS:stylesheet", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28065", "description": "Eject Theme <=2.17 unauthenticated local file inclusion via stylesheet param", "method": "GET", "mode": "block", "severity": 8.1, "slug": "eject", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28065-04": {"action": "init", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28065", "description": "Eject Theme <=2.17 unauthenticated local file inclusion via file param", "method": "GET", "mode": "block", "severity": 8.1, "slug": "eject", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28079-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28079", "description": "conquerors theme <= 1.2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "conquerors", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28079-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28079", "description": "conquerors theme <= 1.2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "conquerors", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28096-01": {"ajax_action": "wealthco_ajax_get_posts", "conditions": [{"name": "ARGS:/^(blog_template|template|template_name|file_name|file|tpl)$/", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28096", "description": "WealthCo Theme <=2.18 unauthenticated local file inclusion via wealthco_ajax_get_posts AJAX", "mode": "block", "severity": 8.1, "slug": "wealthco", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.18"}, "RULE-CVE-2026-28098-01": {"ajax_action": "save_life_get_linked_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|proc[\\\\\\\\/]self[\\\\\\\\/]|boot[\\\\\\\\/]grub))~i"}], "cve": "CVE-2026-28098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28098", "description": "Save Life <=1.2.13 unauthenticated local file inclusion via save_life_get_linked_data AJAX handler", "mode": "block", "severity": 8.1, "slug": "save-life", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28098-02": {"ajax_action": "save_life_ajax_get_posts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|proc[\\\\\\\\/]self[\\\\\\\\/]|boot[\\\\\\\\/]grub))~i"}], "cve": "CVE-2026-28098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28098", "description": "Save Life <=1.2.13 unauthenticated local file inclusion via save_life_ajax_get_posts AJAX handler", "mode": "block", "severity": 8.1, "slug": "save-life", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28117-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28117", "description": "smartSEO theme <= 2.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "smartseo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.9"}, "RULE-CVE-2026-28117-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28117", "description": "smartSEO theme <= 2.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "smartseo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.9"}, "RULE-CVE-2026-28118-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28118", "description": "welldone theme <= 2.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "welldone", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2026-28118-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28118", "description": "welldone theme <= 2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "welldone", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2026-28119-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28119", "description": "nir-vana theme <= 2.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "nir_vana", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2026-28119-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28119", "description": "nir-vana theme <= 2.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "nir_vana", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2026-28121-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28121", "description": "andersonclinic theme <= 1.4.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "andersonclinic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-28121-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28121", "description": "andersonclinic theme <= 1.4.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "andersonclinic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-28123-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28123", "description": "veil theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "veil", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28123-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28123", "description": "veil theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "veil", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28124-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28124", "description": "notarius theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "notarius", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28124-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28124", "description": "notarius theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "notarius", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28125-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28125", "description": "midi theme <= 1.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "midi", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.14"}, "RULE-CVE-2026-28125-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28125", "description": "midi theme <= 1.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "midi", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.14"}, "RULE-CVE-2026-28129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28129", "description": "little-birdies theme <= 1.3.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "little-birdies", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.16"}, "RULE-CVE-2026-28129-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28129", "description": "little-birdies theme <= 1.3.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "little-birdies", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.16"}, "RULE-CVE-2026-28133-02": {"ajax_action": "upload_file", "conditions": [{"name": "ARGS:_chunkedd", "type": "regex", "value": "~<[?%](?:php|=)~i"}], "cve": "CVE-2026-28133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28133", "description": "Filr Protection <=1.2.14 arbitrary file write via chunked upload (_chunkedd) in upload_file AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "filr-protection", "tags": ["arbitrary-file-upload", "arbitrary-file-write", "authenticated"], "target": "plugin", "versions": "<=1.2.14"}, "RULE-CVE-2026-28175-01": {"action": "admin_init", "conditions": [{"name": "ARGS:from_dt", "type": "regex", "value": "~[\\"\']\\\\s*>|]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2026-28175", "description": "Visitors Traffic Real-Time Statistics <=8.11 reflected XSS via unescaped from_dt parameter on the admin overview page", "mode": "block", "severity": 7.1, "slug": "visitors-traffic-real-time-statistics", "target": "plugin", "versions": "<=8.11"}, "RULE-CVE-2026-28175-02": {"action": "admin_init", "conditions": [{"name": "ARGS:to_dt", "type": "regex", "value": "~[\\"\']\\\\s*>|]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2026-28175", "description": "Visitors Traffic Real-Time Statistics <=8.11 reflected XSS via unescaped to_dt parameter on the admin overview page", "mode": "block", "severity": 7.1, "slug": "visitors-traffic-real-time-statistics", "target": "plugin", "versions": "<=8.11"}, "RULE-CVE-2026-28176-01": {"ajax_action": "bookactiRefundBookings", "conditions": [{"name": "ARGS:refund_message", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-28176", "description": "Booking Activities <=1.18.4 unauthenticated PHP object injection via refund_message parameter in bookactiRefundBookings AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-activities", "target": "plugin", "versions": "<=1.18.4"}, "RULE-CVE-2026-28176-02": {"ajax_action": "bookactiUpdateForm", "conditions": [{"name": "ARGS:form_title", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-28176", "description": "Booking Activities <=1.18.4 PHP object injection via form_title parameter in bookactiUpdateForm AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-activities", "target": "plugin", "versions": "<=1.18.4"}, "RULE-CVE-2026-2826-01": {"ajax_action": "kadence_import_process_pattern", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-2826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2826", "description": "Kadence Blocks <=3.6.4 missing authorization on kadence_import_process_pattern allows authenticated users without upload_files capability to import arbitrary content", "mode": "block", "severity": 4.3, "slug": "kadence-blocks", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.4"}, "RULE-CVE-2026-2830-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pmxi-admin-import"}, {"name": "ARGS:filepath", "type": "regex", "value": "~(?:<[^>]+>|%3c[^%]*%3e|javascript:|on[a-z]+[ \\t]*=)~i"}], "cve": "CVE-2026-2830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2830", "description": "WP All Import <=4.0.0 reflected XSS via filepath parameter on import wizard admin page (GET)", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-all-import", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-2830-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pmxi-admin-import"}, {"name": "ARGS:filepath", "type": "regex", "value": "~(?:<[^>]+>|%3c[^%]*%3e|javascript:|on[a-z]+[ \\t]*=)~i"}], "cve": "CVE-2026-2830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2830", "description": "WP All Import <=4.0.0 reflected XSS via filepath parameter on import wizard admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-all-import", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-2831-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mailarchiver-viewer"}, {"name": "ARGS:logid", "type": "detectSQLi"}], "cve": "CVE-2026-2831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2831", "description": "MailArchiver <=4.5.0 authenticated SQL injection via logid parameter on events viewer admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "mailarchiver", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2831-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mailarchiver-viewer"}, {"name": "ARGS:eventid", "type": "detectSQLi"}], "cve": "CVE-2026-2831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2831", "description": "MailArchiver <=4.5.0 authenticated SQL injection via eventid parameter on events viewer admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "mailarchiver", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2837-01": {"ajax_action": "ric_plugin_save_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]|]|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2837", "description": "Ricerca Smart Search <=1.1.12 authenticated stored XSS via plugin settings in ric_plugin_save_settings", "mode": "block", "severity": 4.4, "slug": "ricerca-smart-search", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.1.12"}, "RULE-CVE-2026-2840-01": {"action": "init", "conditions": [{"name": "ARGS:eeb_mail", "type": "regex", "value": "~]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=|javascript\\\\s*:~i"}], "cve": "CVE-2026-2840", "description": "Email Encoder Bundle <=2.4.4 reflected XSS via eeb_mail parameter in eeb_mailto shortcode", "mode": "block", "severity": 6.4, "slug": "email-encoder-bundle", "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-28557-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpforo_synch_roles"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-28557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28557", "description": "wpForo Forum >=2.4.0 <2.4.16 missing authorization on wpforo_synch_roles AJAX handler allows privilege escalation via bulk usergroup-to-role reassignment", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control", "role-remapping"], "target": "plugin", "versions": ">=2.4.0 <2.4.16"}, "RULE-CVE-2026-28562-01": {"action": "init", "conditions": [{"name": "ARGS:wpfob", "type": "detectSQLi"}], "cve": "CVE-2026-28562", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28562", "description": "wpForo Forum >=2.4.0 <2.4.15 unauthenticated SQL injection via wpfob ORDER BY parameter", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "order-by-injection"], "target": "plugin", "versions": ">=2.4.0 <2.4.15"}, "RULE-CVE-2026-2868-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|admin-ajax)\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~separatorIconSVG[^a-zA-Z0-9_][\\\\s\\\\S]{0,400}?(?:]|on(?:error|load|click|mouseover|focus|animationend|animationstart|toggle|pointerenter|pointerover)\\\\s*=|javascript\\\\s*:|]*\\\\son[a-z]+\\\\s*=|]*\\\\son[a-z]+\\\\s*=|%3[Cc]script|]|]|])~i"}], "cve": "CVE-2026-2868", "description": "Gutenverse <=3.5.3 contributor+ stored XSS via separatorIconSVG Breadcrumb block attribute persisted via classic post save / admin-ajax", "mode": "block", "severity": 6.4, "slug": "gutenverse", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2868-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/~"}, {"name": "ARGS", "type": "regex", "value": "~separatorIconSVG[^a-zA-Z0-9_][\\\\s\\\\S]{0,400}?(?:]|on(?:error|load|click|mouseover|focus|animationend|animationstart|toggle|pointerenter|pointerover)\\\\s*=|javascript\\\\s*:|]*\\\\son[a-z]+\\\\s*=|]*\\\\son[a-z]+\\\\s*=|%3[Cc]script|]|]|])~i"}], "cve": "CVE-2026-2868", "description": "Gutenverse <=3.5.3 contributor+ stored XSS via separatorIconSVG Breadcrumb block attribute through REST API post save", "mode": "block", "severity": 6.4, "slug": "gutenverse", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2879-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/getgenie/v1/geniechat(?:/|\\\\?|&|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2879", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2879", "description": "GetGenie <=4.3.2 authenticated (Author+) IDOR allows arbitrary post overwrite via id parameter in getgenie/v1/chat REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "getgenie", "tags": ["idor", "broken-access-control", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-2890-01": {"ajax_action": "frm_forms_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[a-zA-Z][^>]*\\\\s+on[a-zA-Z]+=|]*>|javascript\\\\s*:|]*>|]*>|]*>|]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2026-2890", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2890", "description": "Formidable Forms <=6.28 reflected/stored XSS via item_meta in form preview AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "formidable", "tags": ["xss", "unauthenticated", "reflected-xss"], "target": "plugin", "versions": "<=6.28"}, "RULE-CVE-2026-2918-01": {"ajax_action": "ha_condition_update", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[\\"\'] *on[a-z]+ *=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2918", "description": "Happy Elementor Addons <=3.21.0 IDOR + Stored XSS via ha_condition_update AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "tags": ["idor", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=3.21.0"}, "RULE-CVE-2026-2924-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~imageLoad[\\\\\\\\\\"\':=\\\\s]*(?:on(?:load|error|mouseover|click|focus|blur|mousedown|mouseup|keydown|keyup|input|change)\\\\s*=|javascript\\\\s*:|]|]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2924", "description": "Gutenverse <=3.4.6 authenticated (Contributor+) stored XSS via imageLoad block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-2924-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~imageLoad[\\\\\\\\\\"\':=\\\\s]*(?:on(?:load|error|mouseover|click|focus|blur|mousedown|mouseup|keydown|keyup|input|change)\\\\s*=|javascript\\\\s*:|]|]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2924", "description": "Gutenverse <=3.4.6 authenticated (Contributor+) stored XSS via imageLoad block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-2936-03": {"ajax_action": "today_traffic_index", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:fdt", "type": "regex", "value": "~(?:\\"\\\\s*>]*>.*?|<[^>]+\\\\s+on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2936", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2936", "description": "Visitors Traffic Real Time Statistics <=8.4 reflected XSS via fdt parameter in today_traffic_index AJAX handler", "mode": "block", "severity": 7.2, "slug": "visitors-traffic-real-time-statistics", "tags": ["xss", "reflected", "authenticated", "ajax"], "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-2936-04": {"ajax_action": "visits_time_graph", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:fdt", "type": "regex", "value": "~(?:\\"\\\\s*>]*>.*?|<[^>]+\\\\s+on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2936", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2936", "description": "Visitors Traffic Real Time Statistics <=8.4 reflected XSS via fdt parameter in visits_time_graph AJAX handler", "mode": "block", "severity": 7.2, "slug": "visitors-traffic-real-time-statistics", "tags": ["xss", "reflected", "authenticated", "ajax"], "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-2941-01": {"ajax_action": "linksy_search_and_replace_item_details", "conditions": [{"name": "ARGS:option", "type": "equals", "value": "set"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_item_details allowing subscriber+ arbitrary database update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-db-update"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2941-02": {"ajax_action": "linksy_search_and_replace_replace_db", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_replace_db allowing subscriber+ bulk arbitrary database update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-db-update"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2941-03": {"ajax_action": "linksy_search_and_replace_fetch_db_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_fetch_db_list allowing subscriber+ database table enumeration", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2942-01": {"ajax_action": "proSol_fileUploadProcess", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.ht(?:access|passwd)$~i"}], "cve": "CVE-2026-2942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2942", "description": "ProSolution WP Client <=1.9.9 unauthenticated arbitrary file upload via proSol_fileUploadProcess AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "prosolution-wp-client", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-2942-02": {"ajax_action": "proSol_fileUploadModalProcess", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.ht(?:access|passwd)$~i"}], "cve": "CVE-2026-2942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2942", "description": "ProSolution WP Client <=1.9.9 unauthenticated arbitrary file upload via proSol_fileUploadModalProcess AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "prosolution-wp-client", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-2948-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-client/v2/import/images(?:[/?&]|$)~"}, {"name": "ARGS:imageUrl", "type": "regex", "value": "~^(?:ftp|file|dict|gopher|ssh|smtp|news|telnet|nntp|irc|imap|mongo):|^(?:https?:)?//(?:localhost|127\\\\.0\\\\.0\\\\.1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.169\\\\.254|0\\\\.0\\\\.0\\\\.0|/|[a-zA-Z]:\\\\\\\\|[a-zA-Z0-9.-]+\\\\.internal)~i"}], "cve": "CVE-2026-2948", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2948", "description": "Gutenverse <=3.5.3 server-side request forgery via imageUrl in import_images REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2951-01": {"ajax_action": "gutentor_deactivate_block", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_deactivate_block AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-02": {"ajax_action": "gutentor_activate_block", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_activate_block AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-03": {"ajax_action": "gutentor_bulk_activate_blocks", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_bulk_activate_blocks AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-04": {"ajax_action": "gutentor_bulk_deactivate_blocks", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_bulk_deactivate_blocks AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2987-01": {"action": "init", "conditions": [{"name": "ARGS:sac_text", "type": "exists"}, {"name": "ARGS:sac_text", "type": "regex", "value": "~(?:]|]*on[a-z]+=|]*on(?:error|load)\\\\s*=|javascript\\\\s*:|]|]|]|on(?:error|load|click|mouseover|focus)\\\\s*=)~i"}], "cve": "CVE-2026-2987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2987", "description": "Simple Ajax Chat <=20260217 unauthenticated stored XSS via chat message", "method": "POST", "mode": "block", "severity": 6.1, "slug": "simple-ajax-chat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=20260217"}, "RULE-CVE-2026-2991-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kivicare/v1/auth/patient/social-login([/?&]|$)~i"}], "cve": "CVE-2026-2991", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2991", "description": "KiviCare <=4.1.2 unauthenticated authentication bypass via patient-social-login REST endpoint \\u2014 vendor deleted the entire endpoint in fix", "method": "POST", "mode": "block", "severity": 9.8, "slug": "kivicare-clinic-management-system", "tags": ["authentication-bypass", "unauthenticated", "rest-api", "improper-authentication"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2026-2992-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kivicare/v1/setup-wizard/clinic([/?&]|$)~"}, {"name": "missing_capability", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2992", "description": "KiviCare Clinic Management System <=4.1.2 missing authorization on setup wizard clinic REST endpoint", "method": "POST", "mode": "block", "severity": 8.2, "slug": "kivicare-clinic-management-system", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2026-2992-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kivicare/v1/setup-wizard/step-complete([/?&]|$)~"}, {"name": "missing_capability", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2992", "description": "KiviCare Clinic Management System <=4.1.2 missing authorization on setup wizard step-complete REST endpoint", "method": "POST", "mode": "block", "severity": 8.2, "slug": "kivicare-clinic-management-system", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2026-2993-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:table", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 missing authorization on waic_* AJAX actions allows unauthenticated access to getListForTbl data endpoint", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["missing-authorization", "sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-2993-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 SQL injection via orderby parameter in waic_* AJAX handler getListForTbl", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-2993-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'[^\']*\'\\\\s*=\\\\s*\'[^\']*\'|\\\\b(?:OR|AND)\\\\s+1\\\\s*=\\\\s*1)~i"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 SQL injection via search parameter in waic_* AJAX handler getListForTbl", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-2996-01": {"action": "init", "conditions": [{"name": "ARGS:add-to-cart", "type": "exists"}, {"name": "ARGS:wapf_field_groups", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-2996", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2996", "description": "Advanced Product Fields for WooCommerce <=1.6.21 improper input validation allows required paid addon price bypass via blank wapf_field_groups on add-to-cart", "mode": "block", "severity": 7.5, "slug": "advanced-product-fields-for-woocommerce", "tags": ["improper-input-validation", "business-logic", "price-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=1.6.21"}, "RULE-CVE-2026-3003-01": {"action": "admin_init", "conditions": [{"name": "ARGS:vagaro_command", "type": "regex", "value": "~^(?:Add|Update)$~i"}, {"name": "ARGS:vagaro_code", "type": "regex", "value": "~(?:<(?:script|svg|math|embed|object)[^>]*|&#(?:0*60|x0*3c);?(?:script|svg|math|embed|object)|on[a-z]{3,16}[[:space:]]*=|javascript[[:space:]]*:|&#(?:0*106|x0*6a);?&#(?:0*97|x0*61);?&#(?:0*118|x0*76);?&#(?:0*97|x0*61);?&#(?:0*115|x0*73);?&#(?:0*99|x0*63);?&#(?:0*114|x0*72);?&#(?:0*105|x0*69);?&#(?:0*112|x0*70);?&#(?:0*116|x0*74);?[[:space:]]*:)~i"}], "cve": "CVE-2026-3003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3003", "description": "Vagaro Booking Widget <=0.3 unauthenticated stored XSS via vagaro_code on admin_init POST handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "vagaro-booking-widget", "tags": ["xss", "stored-xss", "unauthenticated", "admin-post"], "target": "plugin", "versions": "<=0.3"}, "RULE-CVE-2026-3018-01": {"ajax_action": "newsletters_api", "conditions": [{"name": "ARGS:wpmlsubscriber_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-3018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3018", "description": "Newsletters <=4.13 unauthenticated time-based SQL injection via wpmlsubscriber_id parameter in newsletters_api AJAX handler", "mode": "block", "severity": 7.5, "slug": "newsletters-lite", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-3056-01": {"ajax_action": "seraph_accel_api", "conditions": [{"name": "ARGS:fn", "type": "equals", "value": "LogClear"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3056", "description": "Seraphinite Accelerator <=2.28.14 missing authorization on LogClear via seraph_accel_api AJAX handler", "mode": "block", "severity": 4.3, "slug": "seraphinite-accelerator", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.28.14"}, "RULE-CVE-2026-3058-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "seraph_accel_api"}, {"name": "ARGS:fn", "type": "equals", "value": "GetData"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3058", "description": "Seraphinite Accelerator <=2.28.14 unauthenticated sensitive information exposure via admin-post.php nopriv route with fn=GetData", "mode": "block", "severity": 4.3, "slug": "seraphinite-accelerator", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.28.14"}, "RULE-CVE-2026-3090-01": {"ajax_action": "ps-get-email-logs", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:]+on[a-zA-Z]+[[:space:]]*=|javascript[[:space:]]*:)~i"}], "cve": "CVE-2026-3090", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3090", "description": "Post SMTP <=3.8.0 stored XSS via unescaped event_type rendering in ps-get-email-logs AJAX response", "method": "POST", "mode": "block", "severity": 7.2, "slug": "post-smtp", "tags": ["xss", "stored-xss", "ajax", "email-logs"], "target": "plugin", "versions": "<=3.8.0"}, "RULE-CVE-2026-3098-01": {"ajax_action": "smart-slider3", "conditions": [{"name": "ARGS:nextendcontroller", "type": "regex", "value": "~^sliders?$~i"}, {"name": "ARGS:nextendaction", "type": "regex", "value": "~^export~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3098", "description": "Smart Slider 3 <=3.5.1.33 arbitrary file read via export \\u2014 restricts slider export to admins only (blocks subscriber/editor-level exploitation)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "smart-slider-3", "tags": ["arbitrary-file-read", "lfi", "missing-authorization"], "target": "plugin", "versions": "<=3.5.1.33"}, "RULE-CVE-2026-3129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~]|\\\\r|\\\\n)*\\\\bon[a-z]{3,20}\\\\s*=~i"}], "cve": "CVE-2026-3129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3129", "description": "LiteSpeed Cache <=7.7 stored XSS via crafted img tag attributes bypassing Lazy Load Images width/height stripping regex; blocks malicious img event-handler payloads submitted in post content by Author-level accounts", "mode": "block", "severity": 6.4, "slug": "litespeed-cache", "tags": ["xss", "stored", "authenticated", "content-injection"], "target": "plugin", "versions": "<=7.7"}, "RULE-CVE-2026-3129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~]|\\\\r|\\\\n)*\\\\bon[a-z]{3,20}\\\\s*=~i"}], "cve": "CVE-2026-3129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3129", "description": "LiteSpeed Cache <=7.7 stored XSS via crafted img tag attributes bypassing Lazy Load Images width/height stripping regex; blocks malicious img event-handler payloads submitted in post content by Author-level accounts", "mode": "block", "severity": 6.4, "slug": "litespeed-cache", "tags": ["xss", "stored", "authenticated", "content-injection"], "target": "plugin", "versions": "<=7.7"}, "RULE-CVE-2026-3132-01": {"ajax_action": "jltma_widget_render_preview", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) RCE via jltma_widget_render_preview AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "remote-code-execution", "code-injection"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-02": {"ajax_action": "jltma_widget_save_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) RCE via jltma_widget_save_data AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "remote-code-execution", "code-injection"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-03": {"ajax_action": "jltma_widget_get_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized data access via jltma_widget_get_data AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-04": {"ajax_action": "jltma_widget_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized widget deletion via jltma_widget_delete AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-05": {"ajax_action": "jltma_widget_update_category", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized category update via jltma_widget_update_category AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-06": {"ajax_action": "jltma_widget_get_conditions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized conditions read via jltma_widget_get_conditions AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-07": {"ajax_action": "jltma_widget_save_conditions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized conditions save via jltma_widget_save_conditions AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3138-01": {"ajax_action": "delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3138", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3138", "description": "Product Filter for WooCommerce by WBW <=3.1.2 missing authorization on delete AJAX handler allows unauthenticated filter data deletion", "mode": "block", "severity": 6.5, "slug": "woo-product-filter", "tags": ["missing-authorization", "data-deletion", "unauthenticated"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2026-3143-01": {"ajax_action": "boldgrid_cli_cancel_rollback", "conditions": [{"type": "missing_capability", "value": "update_plugins"}], "cve": "CVE-2026-3143", "description": "Total Upkeep (boldgrid-backup) <=1.17.1 missing authorization on boldgrid_cli_cancel_rollback AJAX action allows unauthenticated rollback cancellation", "mode": "block", "severity": 5.3, "slug": "boldgrid-backup", "target": "plugin", "versions": "<=1.17.1"}, "RULE-CVE-2026-3174-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/commerce/stripe/return~i"}, {"name": "ARGS:stripe", "type": "exists"}], "cve": "CVE-2026-3174", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3174", "description": "Event Tickets and Registration <=5.27.4 unauthenticated Stripe merchant credential overwrite via public GET to the Stripe OAuth return endpoint (permission_callback __return_true)", "mode": "block", "severity": 7.5, "slug": "event-tickets", "tags": ["missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.27.4"}, "RULE-CVE-2026-3178-01": {"action": "init", "conditions": [{"name": "ARGS:name_directory_name", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|&#(?:0*6[02]|x0*3[cCeE]);|<|>~i"}, {"name": "ARGS:directory", "type": "exists"}], "cve": "CVE-2026-3178", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3178", "description": "Name Directory <=1.32.1 unauthenticated stored XSS via name_directory_name parameter in public submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.32.1"}, "RULE-CVE-2026-3178-02": {"action": "init", "conditions": [{"name": "ARGS:name_directory_description", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|&#(?:0*6[02]|x0*3[cCeE]);|<|>~i"}, {"name": "ARGS:directory", "type": "exists"}], "cve": "CVE-2026-3178", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3178", "description": "Name Directory <=1.32.1 unauthenticated stored XSS via name_directory_description parameter in public submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.32.1"}, "RULE-CVE-2026-3180-01": {"ajax_action": "post_cg1l_resend_unconfirmed_mail_frontend", "conditions": [{"name": "ARGS:cgl_mail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.4 unauthenticated SQL injection via cgl_mail in post_cg1l_resend_unconfirmed_mail_frontend", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.4"}, "RULE-CVE-2026-3180-02": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:cgl_mail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.4 unauthenticated SQL injection via cgl_mail in post_cg_login", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.4"}, "RULE-CVE-2026-3180-03": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:cgLostPasswordEmail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.3 unauthenticated SQL injection via cgLostPasswordEmail in post_cg_login", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.3"}, "RULE-CVE-2026-31921-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcpr/api/wcpr(?:update|settings_update)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-31921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-31921", "description": "Product Rearrange for WooCommerce <=1.2.2 unauthenticated broken access control on wcprupdate REST route", "mode": "block", "severity": 8.2, "slug": "products-rearrange-woocommerce", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-31921-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcpr/api/wcprsettings_update(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-31921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-31921", "description": "Product Rearrange for WooCommerce <=1.2.2 unauthenticated broken access control on wcprsettings_update REST route", "mode": "block", "severity": 8.2, "slug": "products-rearrange-woocommerce", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-3222-01": {"ajax_action": "wpgmp_ajax_call", "conditions": [{"name": "ARGS:location_id", "type": "regex", "value": "~(?:UNION[^a-zA-Z]+(?:ALL[^a-zA-Z]+)?SELECT|(?:AND|OR)[^a-zA-Z]+(?:SLEEP|BENCHMARK|IF|CASE)[^a-zA-Z]*[(]|(?:AND|OR)[^a-zA-Z]+[0-9]+[^a-zA-Z]*=[^a-zA-Z]*[0-9]|SLEEP[^a-zA-Z]*[(]|BENCHMARK[^a-zA-Z]*[(])~i"}], "cve": "CVE-2026-3222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3222", "description": "WP Maps <=4.9.1 unauthenticated time-based blind SQL injection via location_id parameter in wpgmp_ajax_call AJAX handler", "mode": "block", "severity": 7.5, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=4.9.1"}, "RULE-CVE-2026-3226-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lp/v1/send-email(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3226", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3226", "description": "LearnPress <=4.3.2.8 missing authorization on SendEmailAjax REST endpoints allows Subscriber+ to trigger arbitrary email notifications", "method": "POST", "mode": "block", "severity": 4.3, "slug": "learnpress", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2.8"}, "RULE-CVE-2026-3228-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:snapFB", "type": "regex", "value": "~(?:]|]|on(?:error|load|click|mouseover|focus)[ ]*=|javascript[ ]*:)~i"}], "cve": "CVE-2026-3228", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3228", "description": "NextScripts: Social Networks Auto-Poster <=4.4.6 Stored XSS via snapFB post meta parameter during post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2026-32358-01": {"ajax_action": "WPBC_AJX_BOOKING_LISTING", "conditions": [{"name": "ARGS:wh_booking_date", "type": "detectSQLi"}], "cve": "CVE-2026-32358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32358", "description": "Booking Calendar <=10.14.15 blind SQL injection via date interval parameters in WPBC_AJX_BOOKING_LISTING AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "booking", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=10.14.15"}, "RULE-CVE-2026-32358-02": {"ajax_action": "WPBC_AJX_BOOKING_LISTING", "conditions": [{"name": "ARGS:wh_modification_date", "type": "detectSQLi"}], "cve": "CVE-2026-32358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32358", "description": "Booking Calendar <=10.14.15 blind SQL injection via modification date interval parameter in WPBC_AJX_BOOKING_LISTING AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "booking", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=10.14.15"}, "RULE-CVE-2026-3239-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[testimonial_view\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|]|javascript\\\\s*:|<[a-z][^>]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3239", "description": "Strong Testimonials <=3.2.21 stored XSS via testimonial_view shortcode attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.2.21"}, "RULE-CVE-2026-3239-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[testimonial_view\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|]|javascript\\\\s*:|<[a-z][^>]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3239", "description": "Strong Testimonials <=3.2.21 stored XSS via testimonial_view shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.2.21"}, "RULE-CVE-2026-32399-01": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[s]", "type": "regex", "value": "~(?i)(?:[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|UNION[ ]+(?:ALL[ ]+)?SELECT[ ]+|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[s] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-02": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[orderby]", "type": "regex", "value": "~(?i)(?:SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|IF[ ]*[(]|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[orderby] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-03": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[order]", "type": "regex", "value": "~(?i)(?:SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|IF[ ]*[(]|[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[order] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-04": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[post_mime_type]", "type": "regex", "value": "~(?i)(?:[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|UNION[ ]+(?:ALL[ ]+)?SELECT[ ]+|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[post_mime_type] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32413-01": {"ajax_action": "pm_get_uri_editor", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe)[^>]+on[a-z]+=)~i"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 reflected XSS via post_id parameter in pm_get_uri_editor Gutenberg endpoint", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32413-02": {"ajax_action": "pm_bulk_tools", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 missing authorization on pm_bulk_tools allows subscriber+ privilege escalation", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32413-03": {"ajax_action": "pm_detect_duplicates", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 missing authorization on pm_detect_duplicates allows subscriber+ data access", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32414-01": {"ajax_action": "awl-getRuleGroup", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getRuleGroup AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-02": {"ajax_action": "awl-getSuboptionValues", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getSuboptionValues AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-03": {"ajax_action": "awl-getSelectOptionValues", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getSelectOptionValues AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-04": {"ajax_action": "awl-changeLabelStatus", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-changeLabelStatus AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-05": {"ajax_action": "awl-showCurrentHooks", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-showCurrentHooks AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32423-01": {"ajax_action": "svg_get_attachment_url", "conditions": [{"name": "ARGS:attachmentID", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32423", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32423", "description": "Admin Site Enhancements <=8.4.0 missing authorization on svg_get_attachment_url allows contributor+ access to arbitrary attachment URLs", "method": "POST", "mode": "block", "severity": 5.4, "slug": "admin-site-enhancements", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=8.4.0"}, "RULE-CVE-2026-3243-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/amem/avatar/v1/crop(?:[/?]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-3243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3243", "description": "Advanced Members <=1.2.5 authenticated path traversal via REST /amem/avatar/v1/crop leading to arbitrary file deletion", "mode": "block", "severity": 8.8, "slug": "advanced-members", "tags": ["path-traversal", "arbitrary-file-deletion", "rest-api"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2026-3243-02": {"ajax_action": "amem_avatar_crop", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-3243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3243", "description": "Advanced Members <=1.2.5 authenticated path traversal via amem_avatar_crop AJAX handler leading to arbitrary file deletion", "mode": "block", "severity": 8.8, "slug": "advanced-members", "tags": ["path-traversal", "arbitrary-file-deletion", "ajax"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2026-32441-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hw_cmt_csv_im_ex"}, {"name": "ARGS:action", "type": "equals", "value": "export"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32441", "description": "Comments Import & Export <=2.4.9 authenticated (Subscriber+) unauthorized comment export via catch_export_request on init hook", "mode": "block", "severity": 7.7, "slug": "comments-import-export-woocommerce", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-32441-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hw_cmt_csv_im_ex"}, {"name": "ARGS:action", "type": "equals", "value": "settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32441", "description": "Comments Import & Export <=2.4.9 authenticated (Subscriber+) unauthorized settings modification via catch_save_settings on init hook", "mode": "block", "severity": 7.7, "slug": "comments-import-export-woocommerce", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-32459-01": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:order_by", "type": "regex", "value": "~[^a-zA-Z0-9_-]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via order_by parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32459-02": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:limit", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via limit parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32459-03": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via offset parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32461-01": {"ajax_action": "rsssl_force_confirm_email", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32461", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32461", "description": "Really Simple SSL <=9.5.7 missing authorization on rsssl_force_confirm_email AJAX handler", "mode": "block", "severity": 5.3, "slug": "really-simple-ssl", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=9.5.7"}, "RULE-CVE-2026-32461-02": {"ajax_action": "rsssl_resend_verification_email", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32461", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32461", "description": "Really Simple SSL <=9.5.7 missing authorization on rsssl_resend_verification_email AJAX handler", "mode": "block", "severity": 5.3, "slug": "really-simple-ssl", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=9.5.7"}, "RULE-CVE-2026-32463-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/sps/v1/data[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/sps_select_website|sps_website/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|(?:php|phar|data|expect|zip|glob)://)~i"}], "cve": "CVE-2026-32463", "description": "Sync Post With Other Site <=1.9.3 path traversal/LFI via sps_website and sps_select_website REST parameters at /wp-json/sps/v1/data", "mode": "block", "slug": "sync-post-with-other-site", "target": "plugin", "versions": "<=1.9.3"}, "RULE-CVE-2026-32463-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/sps/v1/data[\\\\\\\\/]*$~i"}, {"name": "ARGS:/sps_select_website|sps_website/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|(?:php|phar|data|expect|zip|glob)://)~i"}], "cve": "CVE-2026-32463", "description": "Sync Post With Other Site <=1.9.3 path traversal/LFI via sps_website and sps_select_website REST parameters at /wp-json/sps/v1/data", "mode": "block", "slug": "sync-post-with-other-site", "target": "plugin", "versions": "<=1.9.3"}, "RULE-CVE-2026-32465-01": {"ajax_action": "ere_update_profile_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-32465", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32465", "description": "Essential Real Estate <=5.3.3 authenticated (Customer) PHP Object Injection via ere_update_profile_ajax AJAX handler", "mode": "block", "severity": 8.8, "slug": "essential-real-estate", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.3.3"}, "RULE-CVE-2026-32465-02": {"ajax_action": "ere_register_user_as_agent_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-32465", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32465", "description": "Essential Real Estate <=5.3.3 authenticated (Customer) PHP Object Injection via ere_register_user_as_agent_ajax AJAX handler", "mode": "block", "severity": 8.8, "slug": "essential-real-estate", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.3.3"}, "RULE-CVE-2026-32465-03": {"ajax_action": "ere_change_password_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-32465", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32465", "description": "Essential Real Estate <=5.3.3 authenticated (Customer) PHP Object Injection via ere_change_password_ajax AJAX handler", "mode": "block", "severity": 8.8, "slug": "essential-real-estate", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.3.3"}, "RULE-CVE-2026-32475-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_pro_forms_send_form"}, {"name": "FILES:form_fields", "type": "regex", "value": "~\\\\.(?:phtml?|phps?|php[3-8]|phpt|phar|pht|shtml?|html?|hta|aspx?|swf|jar|exe|com|cmd|csh|bat)[\\\\s.]*$~i"}], "cve": "CVE-2026-32475", "cve_link": "https://patchstack.com/database/wordpress/plugin/elementor-pro/vulnerability/wordpress-elementor-pro-plugin-4-2-1-arbitrary-file-upload-vulnerability", "description": "Elementor Pro unauthenticated arbitrary file upload to RCE through the Forms module File Upload field, blocked at the admin-ajax form-submission endpoint when any submitted file part carries a server-executable extension.", "method": "POST", "mode": "block", "severity": 9.0, "slug": "elementor-pro", "tags": ["arbitrary-file-upload", "unrestricted-file-upload", "remote-code-execution", "unauthenticated", "cwe-434", "elementor-pro", "forms-module"], "target": "plugin", "versions": "<4.2.2"}, "RULE-CVE-2026-32475-02": {"ajax_action": "elementor_pro_forms_send_form", "conditions": [{"name": "FILES:form_fields", "type": "regex", "value": "~\\\\.(?:phtml?|phps?|php[3-8]|phpt|phar|pht|shtml?|html?|hta|aspx?|swf|jar|exe|com|cmd|csh|bat)[\\\\s.]*$~i"}], "cve": "CVE-2026-32475", "cve_link": "https://patchstack.com/database/wordpress/plugin/elementor-pro/vulnerability/wordpress-elementor-pro-plugin-4-2-1-arbitrary-file-upload-vulnerability", "description": "Elementor Pro unauthenticated arbitrary file upload to RCE through the Forms module File Upload field, blocked on the form-submission AJAX hook itself so the protection does not depend on the request URI or on where the action parameter is carried.", "method": "POST", "mode": "block", "severity": 9.0, "slug": "elementor-pro", "tags": ["arbitrary-file-upload", "unrestricted-file-upload", "remote-code-execution", "unauthenticated", "cwe-434", "elementor-pro", "forms-module"], "target": "plugin", "versions": "<4.2.2"}, "RULE-CVE-2026-32482-01": {"ajax_action": "ona_activate_child_theme", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)|\\\\.[Pp][Hh](?:[Pp]\\\\d?|[Ss]|[Tt](?:ml)?|[Aa][Rr]))~"}, {"type": "missing_capability", "value": "switch_themes"}], "cve": "CVE-2026-32482", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32482", "description": "Ona theme <=1.23.2 subscriber+ arbitrary file write/delete via ona_activate_child_theme missing capability check on slug parameter", "mode": "block", "severity": 9.9, "slug": "ona", "tags": ["arbitrary-file-upload", "path-traversal", "missing-authorization", "authenticated"], "target": "theme", "versions": "<=1.23.2"}, "RULE-CVE-2026-32482-02": {"ajax_action": "ona_update_child_theme", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)|\\\\.[Pp][Hh](?:[Pp]\\\\d?|[Ss]|[Tt](?:ml)?|[Aa][Rr]))~"}, {"type": "missing_capability", "value": "switch_themes"}], "cve": "CVE-2026-32482", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32482", "description": "Ona theme <=1.23.2 subscriber+ arbitrary file write/delete via ona_update_child_theme missing capability check on slug parameter", "mode": "block", "severity": 9.9, "slug": "ona", "tags": ["arbitrary-file-upload", "path-traversal", "missing-authorization", "authenticated"], "target": "theme", "versions": "<=1.23.2"}, "RULE-CVE-2026-32484-03": {"ajax_action": "weforms_import_form", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:file_content", "type": "regex", "value": "~(?:O|C):\\\\d+:[^;]{0,256}[{\\"]~"}], "cve": "CVE-2026-32484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32484", "description": "weForms <=1.6.26 authenticated PHP object injection via form import in weforms_import_form AJAX handler", "mode": "block", "severity": 8.8, "slug": "weforms", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.6.26"}, "RULE-CVE-2026-32485-01": {"ajax_action": "wpuf_draft_post", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~^[0-9]+$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32485", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32485", "description": "WP User Frontend <=4.2.8 unauthenticated broken access control allows modifying arbitrary draft posts via wpuf_draft_post AJAX action with post_id parameter", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-user-frontend", "tags": ["broken-access-control", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.2.8"}, "RULE-CVE-2026-32494-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ays-slider~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2026-32494", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32494", "description": "Image Slider by Ays <=2.7.1 reflected XSS via type parameter in admin notices", "method": "GET", "mode": "block", "severity": 7.1, "slug": "ays-slider", "tags": ["xss", "reflected", "admin-page"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-32494-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ays-slider~"}, {"name": "ARGS:slider", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2026-32494", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32494", "description": "Image Slider by Ays <=2.7.1 reflected XSS via slider parameter in admin actions page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "ays-slider", "tags": ["xss", "reflected", "admin-page"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-32498-01": {"ajax_action": "rm_options_default_payment_method", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32498", "description": "RegistrationMagic <=6.0.7.6 missing authorization on rm_options_default_payment_method AJAX handler allows authenticated users to modify payment settings", "mode": "block", "severity": 7.5, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.0.7.6"}, "RULE-CVE-2026-32499-01": {"action": "init", "conditions": [{"name": "ARGS:qc_bot_str_fields", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|(?:[\'\\"][0-9])\\\\s*AND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|SLEEP\\\\s*\\\\(\\\\s*[0-9]|BENCHMARK\\\\s*\\\\(\\\\s*[0-9]|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[a-zA-Z0-9_]+\\\\s*(?:--|#)\\\\s|[\'\\"]\\\\s*--\\\\s|[0-9]\\\\s*--\\\\s)~i"}], "cve": "CVE-2026-32499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32499", "description": "ChatBot <=7.7.9 unauthenticated blind SQL injection via qc_bot_str_fields on init hook", "mode": "block", "severity": 9.3, "slug": "chatbot", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=7.7.9"}, "RULE-CVE-2026-32499-02": {"ajax_action": "wpbo_search_site", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|(?:[\'\\"][0-9])\\\\s*AND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|SLEEP\\\\s*\\\\(\\\\s*[0-9]|BENCHMARK\\\\s*\\\\(\\\\s*[0-9]|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[a-zA-Z0-9_]+\\\\s*(?:--|#)\\\\s|[\'\\"]\\\\s*--\\\\s|[0-9]\\\\s*--\\\\s)~i"}], "cve": "CVE-2026-32499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32499", "description": "ChatBot <=7.7.9 unauthenticated blind SQL injection via s parameter in wpbo_search_site AJAX handler", "mode": "block", "severity": 9.3, "slug": "chatbot", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=7.7.9"}, "RULE-CVE-2026-32513-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2026-32513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32513", "description": "JS Archive List <=6.1.7 PHP Object Injection via serialized included/excluded widget settings", "mode": "block", "severity": 8.8, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-32517-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via s (search) parameter on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "ARGS:paged", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via paged parameter on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "contact-manager-form"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via form-page parameters (id, name, description, etc.)", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via REQUEST_URI on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32520-01": {"ajax_action": "rewardswp_create_member", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|shop_manager)~i"}], "cve": "CVE-2026-32520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32520", "description": "RewardsWP <=1.0.4 unauthenticated privilege escalation via rewardswp_create_member role parameter", "mode": "block", "severity": 9.8, "slug": "rewardswp", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-32520-02": {"ajax_action": "rewardswp_create_member", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~wp_capabilities\\\\[~"}], "cve": "CVE-2026-32520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32520", "description": "RewardsWP <=1.0.4 unauthenticated privilege escalation via rewardswp_create_member wp_capabilities array injection", "mode": "block", "severity": 9.8, "slug": "rewardswp", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-32525-01": {"ajax_action": "jet_fb_ssr_validation_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[\\\\s\\"\',=:])(?:(?:system|exec|passthru|eval|assert|include|include_once|require|require_once)\\\\s*\\\\(|(?:shell_exec|popen|proc_open|pcntl_exec|create_function|call_user_func|call_user_func_array|unserialize|maybe_unserialize|file_get_contents|file_put_contents|fwrite|fopen|curl_exec|preg_replace_callback|array_map|array_filter|array_reduce|usort|uasort|uksort|array_walk|array_walk_recursive)(?:[\\\\s\\"\',;(]|$))~i"}], "cve": "CVE-2026-32525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32525", "description": "JetFormBuilder <=3.5.6.1 unauthenticated RCE via dangerous callback in SSR validation AJAX handler", "mode": "block", "severity": 9.9, "slug": "jetformbuilder", "tags": ["code-injection", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.1"}, "RULE-CVE-2026-32525-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/jet-form-builder/v1/validate-field(?:[/?]|$)~i"}, {"name": "ARGS:callable", "type": "regex", "value": "~^(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|assert|eval|create_function|call_user_func|call_user_func_array)$~i"}], "cve": "CVE-2026-32525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32525", "description": "JetFormBuilder <=3.5.6.1 unauthenticated RCE via dangerous callback in SSR validation REST endpoint", "mode": "block", "severity": 9.9, "slug": "jetformbuilder", "tags": ["code-injection", "remote-code-execution", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.5.6.1"}, "RULE-CVE-2026-32530-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/courses(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API course endpoints", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32530-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/quiz(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API quiz endpoints", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32530-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/migration(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API migration endpoint", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32532-01": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur|toggle)\\\\s*=|javascript\\\\s*:|]|]*onload\\\\s*=|]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via BuddyPress signup_username on bp_signup_validate", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "buddypress"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/register/?(?:\\\\?|$)~"}, {"name": "ARGS:signup_email", "type": "regex", "value": "~(?:]|]*onload\\\\s*=|]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via BuddyPress signup_email on bp_signup_validate", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "buddypress"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:]|/]|/)[^>]*onload(?:\\\\s|/)*=|]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz comment field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:]|/]|/)[^>]*onload(?:\\\\s|/)*=|]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz author field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:email", "type": "regex", "value": "~(?:]|/]|/)[^>]*onload(?:\\\\s|/)*=|]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz email field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32545-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+\\\\bonerror\\\\b|]+\\\\bonload\\\\b|])~i"}], "cve": "CVE-2026-32545", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32545", "description": "Taboola Pixel <=1.1.4 unauthenticated reflected XSS via front-end query parameters", "mode": "block", "severity": 7.1, "slug": "taboola-pixel", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-32546-01": {"action": "init", "conditions": [{"name": "ARGS:rcp_action", "type": "equals", "value": "toggle_auto_renew_off"}, {"name": "ARGS:membership_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-32546", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32546", "description": "Restrict Content <=3.2.22 unauthenticated membership auto-renew toggle via rcp_action parameter", "mode": "block", "severity": 7.5, "slug": "restrict-content", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.2.22"}, "RULE-CVE-2026-32553-01": {"ajax_action": "handle_trigger_button_click", "conditions": [{"name": "ARGS:/st_login_url|st_non_login_url/", "type": "regex", "value": "~(?:(?:https?|ftp|gopher|dict|file|php|ldap)://)?(?:127\\\\.0\\\\.0\\\\.1|0\\\\.0\\\\.0\\\\.0|localhost|169\\\\.254\\\\.169\\\\.254|100\\\\.100\\\\.100\\\\.200|metadata\\\\.google\\\\.internal|\\\\[::1\\\\]|fd00:ec2::254|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[0-1])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3})|^(?:gopher|dict|file|php|ldap)://~i"}], "cve": "CVE-2026-32553", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32553", "description": "OttoKit (SureTriggers) <=1.1.35 unauthenticated SSRF payload via handle_trigger_button_click AJAX st_login_url/st_non_login_url parameters", "mode": "block", "severity": 7.2, "slug": "suretriggers", "tags": ["ssrf", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.1.35"}, "RULE-CVE-2026-32573-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nab/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\?(?:php)?|\\\\b(?:eval|assert|system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec)\\\\s*\\\\(|\\\\b(?:include|require)(?:_once)?\\\\s*\\\\(|`[^`]+`)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32573", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32573", "description": "Nelio A/B Testing <=8.2.7 authenticated (Editor+) remote code execution via PHP snippet scope rules on non-PHP experiment types", "method": "POST", "mode": "block", "severity": 9.1, "slug": "nelio-ab-testing", "tags": ["remote-code-execution", "code-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-3296-01": {"ajax_action": "everest_forms_ajax_form_submission", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-3296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3296", "description": "Everest Forms <=3.4.3 unauthenticated PHP object injection via serialized payload in form field submission (AJAX path)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["object-injection", "deserialization", "unauthenticated", "stored"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-3296-02": {"action": "init", "conditions": [{"name": "ARGS:everest_forms[form_id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-3296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3296", "description": "Everest Forms <=3.4.3 unauthenticated PHP object injection via serialized payload in form field submission (non-AJAX init path)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["object-injection", "deserialization", "unauthenticated", "stored"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-3297-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3297", "description": "Pagelayer <=2.0.9 stored XSS via Anchor block custom_anchor attribute in pagelayer_save_content", "mode": "block", "severity": 6.4, "slug": "pagelayer", "target": "plugin", "versions": "<=2.0.9"}, "RULE-CVE-2026-3297-02": {"ajax_action": "pagelayer_save_templ_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3297", "description": "Pagelayer <=2.0.9 stored XSS via Anchor block custom_anchor attribute in pagelayer_save_templ_content", "mode": "block", "severity": 6.4, "slug": "pagelayer", "target": "plugin", "versions": "<=2.0.9"}, "RULE-CVE-2026-3300-01": {"action": "wp", "conditions": [{"name": "ARGS:everest_forms[id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:[`]|\\\\$\\\\{|\\\\bsystem\\\\s*\\\\(|\\\\bexec\\\\s*\\\\(|\\\\bpassthru\\\\s*\\\\(|\\\\bshell_exec\\\\s*\\\\(|\\\\bpopen\\\\s*\\\\(|\\\\bproc_open\\\\s*\\\\(|\\\\beval\\\\s*\\\\(|\\\\bbase64_decode\\\\s*\\\\(|\\\\bfile_(?:get|put)_contents\\\\s*\\\\(|\\\\bcurl_exec\\\\s*\\\\()~i"}], "cve": "CVE-2026-3300", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3300", "description": "Everest Forms <=1.9.9 unauthenticated RCE via Calculation Addon process_filter() eval injection through form field values", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["code-injection", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-3311-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~tp[_-]progress[_-]bar.*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3311", "description": "The Plus Addons for Elementor <=6.4.9 contributor+ stored XSS via Progress Bar widget attributes", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "target": "plugin", "versions": "<=6.4.9"}, "RULE-CVE-2026-3328-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[redirect]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[redirect] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[custom_url]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[custom_url] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[update_message]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[update_message] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[custom_fields_save]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[custom_fields_save] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3334-01": {"action": "setup_theme", "conditions": [{"name": "ARGS:or_blogname", "type": "regex", "value": "~(?:[\'\\"][^&]{0,128}?(?:OR|AND)\\\\s+(?:[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\(?\\\\s*SELECT\\\\b)|UNION(?:/\\\\*\\\\*/|\\\\s)+(?:ALL(?:/\\\\*\\\\*/|\\\\s)+)?SELECT\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3334", "description": "CMS Commander <=2.288 SQL injection via or_blogname in restore workflow", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cms-commander-client", "tags": ["sql-injection", "custom-auth", "backup-restore"], "target": "plugin", "versions": "<=2.288"}, "RULE-CVE-2026-3334-02": {"action": "setup_theme", "conditions": [{"name": "ARGS:or_blogdescription", "type": "regex", "value": "~(?:[\'\\"][^&]{0,128}?(?:OR|AND)\\\\s+(?:[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\(?\\\\s*SELECT\\\\b)|UNION(?:/\\\\*\\\\*/|\\\\s)+(?:ALL(?:/\\\\*\\\\*/|\\\\s)+)?SELECT\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3334", "description": "CMS Commander <=2.288 SQL injection via or_blogdescription in restore workflow", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cms-commander-client", "tags": ["sql-injection", "custom-auth", "backup-restore"], "target": "plugin", "versions": "<=2.288"}, "RULE-CVE-2026-3334-03": {"action": "setup_theme", "conditions": [{"name": "ARGS:or_admin_email", "type": "regex", "value": "~(?:[\'\\"][^&]{0,128}?(?:OR|AND)\\\\s+(?:[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\(?\\\\s*SELECT\\\\b)|UNION(?:/\\\\*\\\\*/|\\\\s)+(?:ALL(?:/\\\\*\\\\*/|\\\\s)+)?SELECT\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3334", "description": "CMS Commander <=2.288 SQL injection via or_admin_email in restore workflow", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cms-commander-client", "tags": ["sql-injection", "custom-auth", "backup-restore"], "target": "plugin", "versions": "<=2.288"}, "RULE-CVE-2026-3352-01": {"action": "admin_init", "conditions": [{"name": "ARGS:easy_php_settings_wp_memory_settings[wp_memory_limit]", "type": "regex", "value": "~[\';$(){}]~"}], "cve": "CVE-2026-3352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3352", "description": "Easy PHP Settings <=1.0.4 PHP code injection via wp_memory_limit in update_wp_memory_constants()", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-php-settings", "tags": ["code-injection", "php-code-injection", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-3352-02": {"action": "admin_init", "conditions": [{"name": "ARGS:easy_php_settings_wp_memory_settings[wp_max_memory_limit]", "type": "regex", "value": "~[\';$(){}]~"}], "cve": "CVE-2026-3352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3352", "description": "Easy PHP Settings <=1.0.4 PHP code injection via wp_max_memory_limit in update_wp_memory_constants()", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-php-settings", "tags": ["code-injection", "php-code-injection", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-3353-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/options\\\\.php(?:$|\\\\?)~"}, {"name": "ARGS:option_page", "type": "equals", "value": "csw-settings-group"}, {"name": "ARGS:csw_api_key", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|style|link|body|input|details|video|audio|source|math|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|submit|change|input|toggle|animationstart|animationend|animationiteration)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/[a-z+.\\\\-]+\\\\s*;\\\\s*base64|[\\"\'][\\\\s/]*on[a-z]+\\\\s*=|[\\"\']\\\\s*>\\\\s*<)~i"}], "cve": "CVE-2026-3353", "description": "Comment SPAM Wiper <=1.2.1 authenticated (admin) stored XSS via csw_api_key option saved through WordPress Settings API", "mode": "block", "severity": 4.4, "slug": "comment-spam-wiper", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-3354-01": {"action": "admin_post_wikilookup_settings_form_response", "conditions": [{"name": "ARGS:popup_width", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-3354", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3354", "description": "WikiLookup <=1.1.5 stored XSS via Popup Width setting in admin panel", "mode": "block", "severity": 4.4, "slug": "wikilookup", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-3355-01": {"action": "init", "conditions": [{"name": "ARGS:crsearch", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe)[\\\\s/>])~i"}], "cve": "CVE-2026-3355", "description": "Customer Reviews for WooCommerce <=5.101.0 unauthenticated reflected XSS via crsearch query parameter", "mode": "block", "severity": 6.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<=5.101.0"}, "RULE-CVE-2026-3355-02": {"ajax_action": "cr_filter_reviews", "conditions": [{"name": "ARGS:crsearch", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe)[\\\\s/>])~i"}], "cve": "CVE-2026-3355", "description": "Customer Reviews for WooCommerce <=5.101.0 unauthenticated reflected XSS via crsearch in cr_filter_reviews AJAX handler", "mode": "block", "severity": 6.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<=5.101.0"}, "RULE-CVE-2026-3360-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:tutor_action", "type": "equals", "value": "pay_incomplete_order"}, {"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-3360", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3360", "description": "Tutor LMS <=3.9.7 unauthenticated IDOR billing profile overwrite via pay_incomplete_order", "method": "POST", "mode": "block", "severity": 7.5, "slug": "tutor", "tags": ["missing-authorization", "idor", "unauthenticated", "data-tampering"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-3427-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:[/?]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~